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IS THE FEDERAL GOVERNMENT DOING 
ENOUGH TO SECURE CHEMICAL FACILITIES 
AND IS MORE AUTHORITY NEEDED? 


WEDNESDAY, JUNE 15, 2005 

U.S. Senate, 

Committee on Homeland Security 
AND Governmental Affairs, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:24 a.m., in room 
562, Dirksen Senate Office Building, Hon. Susan M. Collins, Chair- 
man of the Committee, presiding. 

Present: Senators Collins, Chafee, Lieberman, Akaka, Carper, 
Lautenberg, and Pryor. 

OPENING STATEMENT OF CHAIRMAN COLLINS 

Chairman CoLLiNS. The Committee will come to order. 

Good morning. First, let me apologize for the late start of the 
hearing this morning. We had a vote on the Senate floor, and it 
seemed to make more sense to vote first; rather than start the 
hearing and immediately have to recess it. So I appreciate your in- 
dulgence. 

Today the Committee is holding its second hearing on the secu- 
rity of our Nation’s chemical industry against terrorist attack. Our 
first hearing, on April 27, examined the chemical sector’s vulner- 
ability to terrorism. Today we will seek answers to the central 
questions that hearing raised: What has been done to secure these 
vital facilities? What remains to be done? And is Federal legislation 
needed? 

We will hear from our distinguished panel of witnesses that Fed- 
eral legislation is indeed needed to give the Department of Home- 
land Security the authority it needs to improve the security of 
chemical sites. 

The clear statement from the Administration that it supports 
new legislation and will work with this Committee to draft a bill 
is a welcome and appreciated development. While I had hoped for 
more detail on what specific authority the Administration believes 
is needed, the acknowledgement that current laws are inadequate 
is a positive first step. 

In the case of chemical security legislation, the devil truly will 
be in the details. In September 2003, and again in March 2004, 
President Bush stated his support for legislation that establishes 
“uniform standards” for the security of chemical facilities. Yet, a bi- 
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partisan legislative approach backed by the Administration has not 
emerged. 

There have been previous efforts. Former EPA Administrator 
Christine Todd Whitman worked with Tom Ridge, then-Director of 
the White House Office of Homeland Security, to develop legisla- 
tion that would have given the EPA authority to regulate chemical 
plant security. According to Governor Whitman, however, the legis- 
lation was killed by a combination of congressional opposition and 
tepid Administration support. 

In the previous Congress, despite the efforts of Senators Inhofe 
and Corzine, a consensus was not reached on a chemical security 
bill. But this issue is simply too important to give in to gridlock 
and to accept inaction. We need to work together, and we need to 
eliminate the stumbling blocks that have tripped up legislative ef- 
forts in the past. 

The stakes are high. As we learned at our first hearing, the EPA 
has catalogued some 15,000 facilities in the United States that 
manufacture, store, or use hazardous chemicals for productive, le- 
gitimate purposes in amounts that could cause extensive harm if 
turned against us as weapons. The Department of Homeland Secu- 
rity uses a different methodology, but still has identified some 
3,400 facilities that could affect more than a thousand people if at- 
tacked. 

Only a fraction of our Nation’s chemical facilities are regulated 
for security by the Federal Government, or subscribe to voluntary 
industry security standards. 

The potential for a catastrophe is not merely theoretical. This 
Committee is cognizant of the 1984 tragedy in Bhopal, India, where 
more than 3,000 people died after an accidental release at a pes- 
ticide plant, and thousands of others suffered injury. 

And just a year ago, in Dalton, Georgia, a reactor overheated and 
released a plume of toxic vapor. This accident sent 150 people to 
the hospital. Carolyn Merritt, the Chairman of the U.S. Chemical 
Safety and Hazard Investigation Board, testified before this Com- 
mittee and described this incident as the poster child of our chem- 
ical vulnerability. In January of this year, a derailed train car in 
South Carolina released chlorine gas, a common chemical used 
throughout industry. Ten people were killed by these toxic fumes, 
and 250 were injured. 

Nor is the potential for terrorists to instigate a chemical catas- 
trophe merely theoretical. As Steven Flynn of the Council of For- 
eign Relations told this Committee at our first hearing, the chem- 
ical industry is at “the top of the list” of al Qaeda and other ter- 
rorist groups. The chemical industry, testified Commander Flynn, 
“absolutely screams at you as essentially a weapon of mass de- 
struction.” 

In describing the risks associated with attacks on chemical facili- 
ties, we often hear the phrases “time bombs” and “Achilles’ heel.” 
At first glance, these metaphors seem apt. In truth, however, they 
miss the mark. Time bombs succeed in their deadly work because 
they are hidden; the intended victims do not know of their exist- 
ence until it is too late. These chemical facilities are not hidden. 
We know they exist. We know precisely where they are, and what 
they contain. And so do the terrorists. 
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Preparing for a potential attack on a chemical facility is pri- 
marily about prevention; but it is also about response. I look for- 
ward to the testimony we will hear today from the EPA witness on 
the Agency’s role as coordinator of response to chemical releases, 
whether accidental or intentional, at most chemical facilities. We 
will also hear from the Department of Homeland Security about in- 
vestigations of chemical sites and other actions that it is taking to 
strengthen security. 

I have quoted two witnesses from the Committee’s first hearing 
to remind us of the threat of a terrorist attack on our chemical in- 
frastructure, and also of the deaths that have resulted from acci- 
dental releases. A statement by a third witness reminds us of why 
this Committee must act. 

Richard Falkenrath, the former Deputy Assistant to the Presi- 
dent for Homeland Security, called the failure to regulate the secu- 
rity of facilities “a major disappointment.” He testified further that, 
“To date, the Federal Government has made no material reduction 
in the inherent vulnerability of hazardous chemical targets within 
the United States.” 

It is time to reduce the vulnerability of our Nation’s chemical fa- 
cilities to terrorist attack. And it is time for us to work together 
with the Administration, with industry and environmental groups 
and other interested parties, to draft a bipartisan bill. 

Senator Lieberman. 

OPENING STATEMENT OF SENATOR LIEBERMAN 

Senator Lieberman. Madam Chairman, thank you very much for 
calling this second in a series of hearings on the security of our Na- 
tion’s chemical plants. With thousands of facilities scattered 
throughout our 50 States, chemical security is a key component of 
our overall homeland defense. 

We have been told in no uncertain terms by independent observ- 
ers that not nearly enough has been done to address this danger. 
The experts have told us that the consequences of an attack on one 
of these chemical facilities could well dwarf the horror we wit- 
nessed and experienced on September 11, 2001. 

Madam Chairman, your willingness to take on this problem, this 
deficiency in our homeland defense, is a real act of public service. 
And I am confident that together we will bring forth legislation 
this year that will diminish greatly our vulnerabilities in this par- 
ticular area. 

We have been warned of the dangers of a chemical catastrophe 
over and over again; and yet we are still at a great distance from 
putting anything approaching a meaningful chemical facility secu- 
rity apparatus in place. 

The Department of Homeland Security has launched a number 
of voluntary security initiatives with the chemical industry. But 
the GAO, the Government Accountability Office, says that these 
programs are still in their infancy. And others have questioned the 
likelihood that voluntary programs are enough to protect our secu- 
rity. 

Allow me to quote Richard Falkenrath again. He said earlier, “It 
is a fallacy to think that profit-maximizing corporations engaged in 
a trade as inherently dangerous as the manufacture and shipment 
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of chemicals will ever voluntarily provide a level of security that is 
appropriate, given the larger external risk to society as a whole.” 

As representatives of that larger society which faces that larger 
risk, we in the Federal Government, I believe, have a responsibility 
to act. Thus far, from the Administration, unfortunately, we have 
seen inaction and indecision. 

In October 2002, as you referenced, then-EPA Administrator 
Whitman and soon-to-be-Homeland Security Secretary Ridge prom- 
ised to work with Congress on legislation, saying that voluntary 
measures alone were insufficient to provide the level of security 
that the American people deserve. Almost 3 years later, nothing 
really has happened. The existing approach continues to be what 
it was then. 

Now, this morning, we will hear an announcement from the De- 
partment that is encouraging; which is to say that the Department 
today, under Secretary Chertoff, has essentially come to the same 
conclusion that Ms. Whitman and Secretary Ridge did earlier, and 
that is that voluntary measures are not enough. 

But I want to appeal to the representatives of the Department 
of Homeland Security and the Environmental Protection Agency 
that are here today, to not let this commitment go the way of the 
good intentions expressed more than 2 years ago — 21/2, nearly 3 
years ago — by Administrator Whitman and Secretary Ridge. 

I appeal to you, as soon as possible, with a real sense of urgency, 
to come forward with specifics about the kind of regulatory and 
protective system that you feel the country needs. I think you will 
find in Senator Collins and me and Members of this Committee a 
willingness to work with the Administration in a genuinely bipar- 
tisan way, because this is a critical national security, and home- 
land security threat. 

I look forward to your testimony, and I look forward to working 
with you to diminishing the present and clear danger that faces the 
American people from an attack or an accident at a chemical facil- 
ity, as quickly as we possibly can. Thank you. 

Chairman COLLINS. Thank you. Senator Lieberman. 

I would now like to welcome our panel of witnesses. Our first 
witness is Colonel Robert B. Stephan. He has perhaps the longest 
title of any witness who has come before this Committee. He is the 
Acting Under Secretary for Information Analysis and Infrastruc- 
ture Protection at the Department of Homeland Security, and the 
Assistant Secretary for Infrastructure Protection. 

So assuming that I got that right, we do welcome you. 

He also served in the Air Force for 24 years, and he has been 
the Senior Director for Critical Infrastructure Protection at the Ex- 
ecutive Office of the President. And we very much appreciate your 
being here. 

Our next witness after the Colonel will be Thomas P. Dunne, 
who is the Deputy Assistant Administrator for the Office of Solid 
Waste and Emergency Response at the EPA. Previously, he held 
several senior level positions at the EPA. 

We are very pleased that both of you could join us here today. 
Colonel Stephan, we are going to start with you. 
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TESTIMONY OF ROBERT B. STEPHAN, i ACTING UNDER SEC- 
RETARY FOR INFORMATION ANALYSIS AND INFRASTRUC- 
TURE PROTECTION, U.S. DEPARTMENT OF HOMELAND SE- 
CURITY 

Mr. Stephan. Madam Chairman, thank you for acknowledging 
my many titles. I also have to admit that I must exercise multiple 
personalities with those titles in order to get the job done here at 
the Department. 

But good morning Madam Chairman, Senator Lieberman, and 
distinguished Members of the Committee. It is absolutely my privi- 
lege to come before you today to discuss the Department of Home- 
land Security’s efforts, in partnership with many other stake- 
holders across the country, to reduce the risk posed to the chemical 
sector — a vitally important sector in our criteria — from potential 
terrorist attack; as well as to give you some idea of the road ahead 
regarding the security of this critical infrastructure sector. 

I think I need to begin by saying that, first and foremost, it is 
very high priority for the Department of Homeland Security to re- 
duce the risk from terrorism by implementing collaborative security 
strategies with Federal, State, local, and private-sector partners, to 
adequately protect the Nation’s chemical infrastructure from ter- 
rorist attack. 

My discussion with you today will include a focus on the risk 
landscape associated with this chemical sector and the important 
collaborative steps that have been taken to close security gaps 
under the existing voluntary public/private sector partnership; but 
also to note, very importantly, that considerable progress has been 
made through these voluntary efforts. But just as importantly, fur- 
ther progress is required to close remaining important security 
gaps. 

As a part of Secretary Chertoff s Second Stage Review of DHS 
policies, operations, and structures, he tasked my team to review 
the current state of security and ensure that we have the proper 
tools to address the threats that face the chemical industiy both 
now and in the future. To that end, we are currently assessing the 
need for a carefully measured, risk-based regulatory regime for this 
sector. 

To close the existing gaps and reduce risk across the chemical 
business, the Federal Government should adhere to certain core 
principles regarding any proposed regulatory structure. First, we 
must recognize that not all facilities within this sector present the 
same level of risk, and that the most scrutiny should absolutely be 
focused on those facilities that, if attacked, could endanger the 
greatest number of American lives, have the greatest impact on the 
American economy, or present other significant risks. 

Second, facility security should be based on reasonable, clear, eq- 
uitable, and measurable performance standards. A regulatory 
framework should include enforceable performance standards based 
on the types and severity of the potential risk posed by the terror- 
ists. Facilities should have the flexibility to select among appro- 
priate, site-specific security measures that will effectively address 
those risks. 


^The prepared statement of Mr. Stephan appears in the Appendix on page 35. 
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Third, we should recognize the progress that many responsible 
companies in this industry have made to date. Many companies 
have made significant capital investments in security since the 
September 11 attacks, and we should build upon that progress col- 
laboratively in constructing delicately the road ahead. 

What is the threat to the chemical sector? The chemical sector, 
just like all other critical infrastructure that we are concerned 
about, is a potential target for terrorist attack. While we, at this 
time, have no specific credible information indicating an immediate 
threat to the chemical sector, the Department remains concerned 
about the potential public health and economic consequences 
should a successful attack take place. 

The chemical sector consists of widely varied and distributed fa- 
cilities. It presents a comprehensive, sweeping challenge to us. The 
particular vulnerability of any specific facility within this overall 
landscape obviously depends on the type and quantity of chemicals 
onboard a site, the physical layout and location of sensitive target 
sets within a site, access points, geographic location, and many 
other variables. Therefore, each facility must have a risk assess- 
ment and a security plan that is tailored to its unique security en- 
vironment and considerations. 

In December 2003, President Bush issue Homeland Security 
Presidential Directive 7, which assigned DHS overall responsibility 
for coordinating the national effort to ensure the protection and se- 
curity of America’s critical infrastructures and key resources in 17 
different categories. 

Additionally, this document requires DHS to develop a sector- 
specific plan for the chemical sector, and to work with public and 
private sector partners across the board to implement the nec- 
essary protective measures aimed at reducing the vulnerabilities 
inherent in this sector. 

In line with the President’s guidance, a large number of security 
visits have been completed by DHS, the Coast Guard, and the In- 
frastructure Protective Division, and protective measures are being 
implemented for the highest-risk chemical sites in the United 
States. The Department continues to visit other chemical facilities 
on a priority basis in coordination with various State homeland se- 
curity advisors, emergency management officials. State and local 
law enforcement officials, and actual individual site owners and op- 
erators. 

DHS and the chemical sector also continue to build a strong part- 
nership based on information sharing and active collaboration. I 
am pleased to report to you that these efforts have yielded a very 
solid information-sharing backbone and network, as well as a com- 
prehensive approach to assessing risk for the sector. 

It is also important to identify the work that the chemical sector 
itself has done to date, in a close partnership with DHS, to take 
care of its security responsibilities. The owners and operators 
across the chemical sector to a large degree are voluntarily under- 
taking a variety of important security initiatives. 

In 2002, the American Chemistry Council developed the Respon- 
sible Care Security Code to help chemical companies achieve im- 
provement across the board in security performance through a fo- 
cused approach based on identifying, assessing, and addressing 
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vulnerabilities; preventing or mitigating incidents; enhancing train- 
ing and response activities and capabilities; and maintaining and 
improving relationships with key Federal, State, and local govern- 
mental partners. 

A component of this Responsible Care Security Code is the re- 
quirement for an independent third-party verification of the secu- 
rity enhancements, as well as the competent completion of the site 
vulnerability assessments that they are tasked to do under this 
code. The ACC estimates that its members have spent over $2 bil- 
lion in securing various sites across the industry, in terms of their 
membership, since the September 11 attacks. 

Closing the gaps, and the path forward. At DHS, a major focus 
of the past 2 years has been developing tools for assessing risks 
and working cooperatively with local jurisdictions and companies 
themselves to implement appropriate protective measures. As we 
further assess the status of the chemical sector’s largely voluntary 
security regime, we have also been evaluating whether or not the 
current scope and level of effort will be sufficient to address impor- 
tant remaining gaps and emerging threats. 

In short, while most companies have been eager to cooperate 
with the Department, it has become clear that the entirely vol- 
untary efforts of these companies alone will not sufficiently address 
security for the entire chemical sector. 

Based upon work done to date, however, we now have much 
greater clarity regarding the tasks ahead, tested tools, and a con- 
siderable knowledge base that will help us make informed deci- 
sions as we go about closing these remaining serious security gaps. 

By exploring all available means to enhance the existing vol- 
untary system, we want to ensure that all facilities have in place 
a core base of preparedness; that those facilities that pose the 
greatest risk are receiving more focused attention; and that the Na- 
tion’s approach to the chemical sector’s security problem will be 
based on reasonable, clear, equitable, and enforceable and measur- 
able performance standards that reflect the diversity of the chem- 
ical sector as well as the responsible security investments that 
have been made across the industry to date. 

Since September 2001, the Administration has worked in part- 
nership with numerous stakeholders to enhance the overall secu- 
rity of this vitally important sector. Through a combination of gov- 
ernance structures, information-sharing mechanisms, risk assess- 
ment and risk-based planning approaches, programmatic initia- 
tives, local law enforcement enhancements, voluntary industry ef- 
forts, the chemical sector has demonstrated considerable progress 
in bolstering its security posture. 

But further progress is required, is needed. By developing a com- 
prehensive risk-based approach for the chemical sector, we expect 
to be able to obtain more closures in a significant way to close re- 
maining gaps in this vitally important area. 

This concludes my prepared remarks. I would be happy to an- 
swer any questions at your time, or defer to you. Madam Chair- 
man. 

Chairman COLLINS. Thank you. Mr. Dunne. 



8 


TESTIMONY OF THOMAS P. DUNNE, i DEPUTY ASSISTANT AD- 
MINISTRATOR, OFFICE OF SOLID WASTE AND EMERGENCY 

RESPONSE, U.S. ENVIRONMENTAL PROTECTION AGENCY 

Mr. Dunne. Thank you, Madam Chairman and Members of the 
Committee. My name is Thomas Dunne, and I am the Deputy As- 
sistant Administrator for EPA’s Office of Solid Waste and Emer- 
gency Response. 

I am pleased to appear today to discuss aspects of EPA’s Emer- 
gency Response Program and, in particular, the chemical site secu- 
rity issues. I will summarize my written statement, but I ask that 
my entire written statement be submitted for the record. 

Chairman COLLINS. Without objection. 

Mr. Dunne. EPA’s Emergency Response Program conducts emer- 
gency clean-up actions at oil and chemical spills and hazardous 
waste sites, and is involved with preparing and planning for chem- 
ical emergencies, working with a network of State and local emer- 
gency planning organizations. 

EPA’s response can cover a wide range of emergencies, including 
the World Trade Center in New York City, Capitol Hill anthrax 
and Ricin clean-ups, and helping to manage a multi-State effort to 
recover debris from the space shuttle Columbia disaster. 

In addition to our emergency support functions, EPA has 
partnered with the Department of Homeland Security and other 
Federal agencies to develop and implement the National Response 
Plan, the National Incident Management System, and the National 
Infrastructure Protection Plan. 

EPA is also responsible for the development and implementation 
of Federal regulations for reporting under the Emergency Planning 
and Community Right To Know Act, the emergency release report- 
ing requirements under the Comprehensive Environmental Re- 
sponse Compensation and Liability Act, the oil spill prevention re- 
sponse planning requirements under the Oil Pollution Act, and 
chemical accident prevention and mitigation under the Clean Air 
Act. 

In response to the terrible consequences of the Bhopal, India 
chemical disaster in 1984, Congress established chemical accident 
prevention programs by enacting the Emergency Planning and 
Community Right To Know Act, and Section 112(r) of the Clean Air 
Act. EPCRA requires States to create State emergency response 
commissions, known as SERCs, and requires local communities to 
form local emergency planning committees, called LEPCs, that 
would prepare local emergency response plans for chemical acci- 
dents. 

EPCRA has also required chemical facilities to provide LEPCs 
with the information needed for emergency planning, and to submit 
annual chemical inventory reports to SERCs, LEPCs, and local fire 
departments. EPCRA does not require facilities to take actions to 
prevent chemical accidents. 

Section 112(r) of the Clean Air Act required stationary facilities 
that handle extremely hazardous materials to prevent and mitigate 
accidental releases into the air. It also required EPA to develop 


^The prepared statement of Mr. Dunne appears in the Appendix on page 44. 
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risk-management requirements for the subset of chemical facilities 
that had large quantities of the most dangerous chemicals. 

EPA subsequently required certain chemical facilities to conduct 
hazard assessments; develop and implement accident prevention 
and response programs; analyze the consequences of worst-case 
and alternative release scenarios; and provide a report called the 
“Risk Management Plan,” or also, RMPs. Approximately 15,000 fa- 
cilities are subject to these RMP requirements. 

Following the September 11 terrorist attacks, one of the actions 
taken by the President was to assign EPA with chemical and 
drinking water security responsibilities. EPA considered using its 
authorities under Section 112(r) to require facilities that handle ex- 
tremely hazardous substances to secure them against terrorist at- 
tack. However, EPA concluded that using the Clean Air Act Section 
112(r) and its language regarding accidental releases to require fa- 
cilities to take additional security measures for a terrorist attack 
would subject the agency to a significant legal vulnerability and re- 
sult in protracted litigation. 

As a practical matter, the issue was overtaken by the creation of 
the Department of Homeland Security. After the creation of the De- 
partment, Homeland Security Presidential Directive 7 made the 
Department the lead for the chemical and hazardous material sec- 
tor concerning infrastructure protection issues. 

The Department is the lead Federal agency for chemical security, 
and EPA serves in a supporting role by providing information and 
analytical support as needed. 

That completes my statement. Madam Chairman. I would be 
pleased to answer any questions that you or the Committee may 
have. 

Chairman COLLINS. Thank you very much, Mr. Dunne. 

Colonel, of the 17 critical infrastructure and key resource sectors 
that the Department is focusing on, where does chemical security, 
the security of chemical sites, rank in the Department’s priorities? 

Mr. Stephan. Well, Senator, according to HSPD-7, the Presi- 
dent’s guidelines are very clear. They push us towards a focus on 
those sectors, first and foremost, that may be through a terrorist 
attack used as weapons of mass destruction or produce mass effects 
against American citizens and the economy. In terms of those 
guidelines, we clearly feel that the chemical sector is right up there 
as one of the top priority sectors of the 17. 

Chairman COLLINS. I know that the Department, along with the 
EPA, has visited many of these chemical facilities, done inspec- 
tions, and made recommendations for security improvements. But, 
at our first hearing on this issue, the GAO testified that, despite 
the potentially catastrophic damage that could be inflicted by an 
attack on a chemical site, a comprehensive security assessment of 
these facilities has not been completed yet. 

GAO testified that, “While DHS and EPA have visited a number 
of facilities to discuss security, the results of these visits are at this 
point unclear.” Could you share with us some of your general find- 
ings as a result of these site visits? 

Mr. Stephan. Yes, ma’am. Just to clarify some of the numbers 
that are important to consider here, as you correctly pointed out, 
we consider among the top tier of chemical facilities across the 
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United States, using EPA metrics that my colleague, Tom, could 
probably go into in a little greater detail — there are about 3,400 
things that we consider high-risk, with the respect to the ability to 
impact a thousand people or greater. 

Within that, we also have several upper-echelon tiers gradated so 
that we have a category between 10,000 and 50,000; 50,000 to 
500,000; and then, above 500,000. Of the top two tiers, the DHS 
will have visited, between the Infrastructure Protection Division 
and the Coast Guard, every single one of the top tier sites. 

Chairman COLLINS. And how many facilities are in the top tiers? 

Mr. Stephan. Two hundred and seventy-two, ma’am. And each 
of those sites is developing and required to turn in to the Depart- 
ment of Homeland Security IP Division buffer zone protection 
plans, which are very sophisticated, law-enforcement-produced — 
State and local law-enforcement-produced, under the supervision of 
the homeland security advisors for the States — detailed plans in 
terms of how the law enforcement — what response law enforcement 
would take; capabilities that need to be addressed, both in terms 
of information connectivity, information sharing, actual response, 
personal protective gear for law enforcement folks. That kind of in- 
formation is due to us in a comprehensive set of plans by Sep- 
tember 30 of this year. 

In addition to that category of planning, the Department has 
made site visits to what we consider to be about three dozen or so 
of the most high-risk top-tier facilities; actual inside-the-fence vul- 
nerability assessments, in partnership and at the invitation of the 
facility owners and operators. And the degree of cooperation that 
we have seen during those particular visits has been very good. 

We have seen various instances, evidence of the $2 billion-plus 
that I mentioned in my formal testimony being spent in terms of 
improved physical enhancements across the sector; improved cyber 
enhancements in terms of security across the sector; additional 
staffing; linkages in terms of information networks, both with us 
and with State and local law enforcement, that would provide the 
bulk of the reinforced response in the event of a terrorist attack. 

We have seen guidelines, the Responsible Care Code, as I men- 
tioned during my testimony. For the members of the chemical sec- 
tor that participate in that code, there I think have been very le- 
gitimate, very real, and very qualitative improvements in security 
across the board. 

But again, there is a certain percentage of the sector — I want to 
estimate, based on input from my folks and as a result of these vis- 
its, in coordination with ACC and other major associations, roughly 
20 percent or so of the capacity — that we would be concerned about 
in terms of risk, that is unaccounted for under the Responsible 
Care Code. And therefore, I cannot come to the President or to you 
with a straight face and say, “Ma’am, I absolutely know what is 
going on there. I am comfortable with it 100 percent.” 

Some of them do let us in. Some of them let us take a lengthier 
look than others. But again, once you get beyond the Responsible 
Care Code, there are really no good metrics, solid metrics. About 
20 percent of things that we consider very important that I just 
cannot report on favorably, one way or the other, to you. 
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Chairman COLLINS. And that is one reason that the Administra- 
tion is supporting legislation, so you will have the authority to re- 
quire a vulnerability assessment of every high-risk chemical site? 
Is that correct? 

Mr. Stephan. What we would like to do, in any kind of regu- 
latory framework that we would envision that security focus — there 
are certain general principles that would have to be brought to the 
table and considered; a credible, competent, credited risk assess- 
ment approach, with a risk assessment methodology that has been 
accepted in some way, shape, or form. 

We have to have security planning, using a risk-based approach, 
based upon those vulnerability assessments or risk assessments. 
We would have to have implementing measures put in place that 
are risk-based, that reflect the risks and the vulnerabilities that 
come about during the assessment process. We would have to have 
some ability to audit those activities, and some general mechanism 
to ensure compliance with everything that I said. 

A lot of these elements have been in various legislative proposals 
that you and others have seen over the past couple of years. And 
that basic framework remains the framework that needs to be an- 
swered and brought to the table, I think, in any kind of proposed 
regulatory structure. 

Chairman COLLINS. Thank you. 

Mr. Dunne, I am trying to understand how we go from the EPA’s 
listing of some 15,000 chemical sites that either store, use, or man- 
ufacture high-risk hazardous chemicals, to DHS’s list of 3,400 
chemical sites that are high-risk. 

The EPA, for example, has estimated that there are 123 facilities 
that, if there was a release, could affect a million or more people. 
I realize we are not talking about casualties necessarily here, but 
an effect on a million or more people. DHS seems to have a far 
more conservative estimate, and comes up with some 300 facilities 
that could affect a population of greater than 50,000 people. 

I am trying to understand what the scope is here, and how we 
go from 15,000 facilities on the EPA’s list to 3,400 facilities on 
DHS’s list. I would like you to start, and then I will ask you. Colo- 
nel, to comment. 

Mr. Dunne. Well, the 15,000 facilities come about because the 
legislation calls for the amount, quantity of facilities, and the types 
of chemicals that are used or stored there. There are 140 different 
chemicals. And then we gauge in terms of what quantity represents 
a potential problem. And it turns out it is 15,000. 

When we went out with the original regulations in 1999, it was 
15,000. We have had a couple thousand go off the list, and a couple 
thousand come on. So the number has not really changed. 

The point of the 123 facilities, I have read the statement and I 
have read news reports about that. And it is generally overstated, 
in terms of what the concern is. Of those 123 facilities, there are 
a million people in the surrounding areas. So if you took the facili- 
ties as a point, a central point, and you reached out and drew a 
radius around it, there would be a million people that, depending 
upon circumstances, could be affected. It certainly does not mean 
anything in terms of fatalities or casualties. 
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The fact is that I believe DHS — and I will let Bob speak more 
directly to it — took a look at analyzing, and that seems to me a 
very reasonable approach, in terms that we do know that wind 
blows in one way; you have atmospheric circumstances that over- 
ride that. A million people are not going to be affected in any one 
place. 

Now, the closer you are to a facility, depending upon the release 
and the type of chemical, it could create problems. So actually, the 
123 is now 110 in the most recent count that our staff did on it. 
And I do not think it is a drop-off, in terms of their logic. Because 
it seems to me that what they did is focus on what are the targets 
that would be of most serious concern, and honing in on those at 
the beginning, and then working your way down the list. 

Chairman COLLINS. Thank you. Colonel, I will come back to you, 
since my time has expired, in the second round. 

Senator Lieberman. 

Senator Lieberman. Thanks, Madam Chairman. It seems to me 
that the big question that has been decided but not acted upon is 
whether voluntary measures by the chemical industry are enough 
in the face of the threat posed here that everyone agrees on. And 
the answer, I believe we will all come to, is that voluntary meas- 
ures are not enough. 

I appreciate and admire the voluntary measures that have been 
taken by the industry, but I think when you set the reality against 
the enormous threat from either a terrorist attack or an accident, 
the Federal Government has to speak for the national security, the 
homeland security, and the public safety, and ask more. 

And I gather from your statement today — I conclude from your 
statement today that the Administration has reached that conclu- 
sion. I quote from. Colonel Stephan, your printed testimony before 
the Committee today, “I can report on his behalf that Secretary 
Chertoff has concluded that, from the regulatory perspective, the 
existing patchwork of authorities does not permit us to regulate the 
industry effectively.” 

To some extent, that mirrors the conclusion that Administrator 
Whitman and Secretary Ridge articulated about 21/2 years ago. So 
let me begin with a general question; which is that the cynics or 
the skeptics would say, well, how is this any different, the an- 
nouncement that you are making this morning on Secretary 
Chertoff s behalf, than the statement that Administrator Whitman 
and Secretary Ridge made 2^2 years ago, which has produced noth- 
ing — I mean, nothing regulatory — since then? 

Mr. Stephan. Sir, thank you for that assessment. I think I want 
to make one clear point; that this is not a change in Bush Adminis- 
tration policy, in terms of going back as far as the President’s phys- 
ical critical infrastructure protection strategy that was released in 
February 2003. 

Basically, he has stated clearly our willingness to work with 
Members of Congress on this issue because it was, even back in 
those days, beginning to be apparent that voluntary efforts alone 
and voluntary codes were not necessarily going to get us to the end 
state across the sector that we would be comfortable with. 

And the Administration has participated in numerous efforts and 
aspects of a dialogue with both houses of Congress over the past 
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couple of years, to try to figure out what the appropriate solution 
might be. 

I think there are two key and very distinct differences that I am 
bringing to the table for you today. Before I get to that, though, the 
new team is onboard. Secretary Chertoff assumed his responsibil- 
ities back in February. I assumed these current responsibilities 
about 7 weeks ago. Secretary Chertoff asked me to take a look, 
under his second stage review, at this chemical security issue, as 
well as the infrastructure protection mission area at large; but 
drilling down within that the things that we think are absolutely 
the most important and significant, need to be accelerated in terms 
of our approach. 

Having said that, basically agreeing with the conclusion that has 
been on the table for the past couple of years, two new dynamics. 
We now have a very clear understanding, I think, of where the vol- 
untary security regime that has been in vogue for the last 3 years 
has taken us. The extent that we are going to be able to get the 
effects we are looking for out of that voluntary regime is now fairly 
clear. 

That regime was just coming on the table, in terms of the private 
sector roll-out of that Responsible Care Code that I discussed, 2 
years ago. So now we clearly understand, working in partnership 
with industry, the extent to where that is going to take us on the 
security spectrum. 

Added to that is 2 years ago, to come to you all with a reasonable 
approach was not as possible as it is today, in terms of risk man- 
agement. We did not have the risk assessment tools — the science. 
The technology was just not there 2 years ago. 

I am happy to report that, in partnership, in full collaboration 
with the chemical sector across the board, we have been working 
diligently for the past year or so to develop an acceptable, measur- 
able, risk-based formula that brings together consequences, vulner- 
ability, and threat into a tool that is Web-based, and that we are 
now finished and ready to deploy uniformly across the chemical 
sector. 

So because of the technology, building upon the baseline of the 
voluntary efforts that have been put into practice up to this point, 
we can come back to you, I think, with a much more measurable, 
sophisticated approach, other than some kind of blanket authority 
to do lots of things across the sector that may or may not be rel- 
evant based on a risk metric. 

Senator Lieberman. I hear you, and I appreciate that. And so 
you have got a better risk-based analysis now, which would be the 
basis for legislation. And you have lived for some period of time 
under the voluntary system. You know what it can do and what it 
can not do. 

Mr. Stephan. Correct. 

Senator Lieberman. What are the major shortcomings of the vol- 
untary system, would you say? What is not being done that we 
would want to do legislatively and by regulatory system? 

Mr. Stephan. Yes, sir, I think basically two answers to that 
question. For the operational capacity that we believe to be high- 
risk, around 20 percent of the overall sector that is not partici- 
pating in any kind of measurable voluntary code, that would allow 
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us to get to that part of the problem and tighten down the loop in 
terms of that. 

Senator Lieberman. Let me make sure I understand that. You 
are saying, based on the risk analysis you are able to do now, that 
20 percent of those facilities that you would consider to be high- 
risk have not assumed on a voluntary basis their responsibility? 

Mr. Stephan. We believe that about 20 percent of the oper- 
ational capacity, in terms of output of the chemical sector, is not 
governed by any kind of voluntary practice or voluntary security 
code. 

Senator Lieberman. Is that 20 percent of those you consider 
high-risk, or 20 percent of the overall community that is chemical? 

Mr. Stephan. That is 20 percent of the overall capacity that we 
would consider to be high-risk. 

Senator Lieberman. Got it. I am sorry, go ahead. 

Mr. Stephan. Yes, sir. So that would attempt to close the gaps 
on that end of the spectrum. 

The other piece that we really want to get to is the pieces of in- 
dustry that have very responsibly been making some very signifi- 
cant investments and enhancements over the past couple of years. 
We want a way to make sure that we can measure those, using 
risk-based metrics and criteria, to ensure that those kinds of meas- 
ures that have been put in place, based upon the unique require- 
ments of every individual facility that we consider to be at high 
risk, are appropriate or having a measurable effect that we can 
then take to the President, report progress, take to you and report 
progress; and to be able to sustain all of that momentum, very im- 
portantly, over time, as we move further and further beyond Sep- 
tember 11. 

Senator Lieberman. I hear you. Let me ask this — there was gen- 
eral feeling on Capitol Hill that EPA under Administrator Whit- 
man had put together a legislative proposal to go beyond voluntary 
initiatives and have some mandated security requirements on part 
of the chemical industry, but it never made it to the Hill. 

My question to you, and to you Colonel Stephan, as we begin 
anew, is whether what you are saying is you are prepared to sup- 
port legislation, or work with us, that a Committee like ours would 
come up with? Or is the Administration intending to make a spe- 
cific legislative proposal in this area? 

Mr. Dunne. Well, let me start, and then Bob can answer. In 
terms of any legislation that was developed at EPA or other places 
in the Administration, there were discussions, but there was noth- 
ing actually developed as such. And it was somewhat abandoned, 
as we had given consideration to see if we could use Section 112(r) 
and whether or not that was a good idea. And besides the lawyers 
bantering back and forth for a period of time, both within EPA and 
also other agency departments, it was decided not to go the legisla- 
tive route. 

And at the same time, when we looked at Section 112(r) we 
thought, from both a legal and a policy consideration, we would 
have been bogged down in the courts in regulations and, to this 
day, we probably would not have anything out. So there was never 
a serious legislative proposal that was forthcoming that would have 
come to 0MB and be transmitted to the Hill. 
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Senator Lieberman. So Colonel, let me ask you the question. Is 
the Administration going to make a specific legislative proposal to 
the Committee? Or are you wanting to just work with Senator Col- 
lins and me and the other Members as we develop legislation? 

Mr. Stephan. What we would like to do, as the point I made ear- 
lier, is that we basically own the metrics, the tool that is going to 
allow us to take what, I think, is a reasonable, rational, measured, 
and effective approach to this. So we own that methodology. What 
we have to do is take that methodology in accelerated fashion and 
build a proposed regulatory framework around that methodology 
through the policy coordination processes of the Homeland Security 
Council. 

Having established and put some more granularity, some more 
bones on the skeleton of my testimony I delivered today, we would 
like to then work with you, based upon that knowledge base we 
have, the technology that has been pushing us over the last 2 
years — work collaboratively with our partners in Congress to put 
the right solution on the table. 

Senator Lieberman. So if I hear you correctly, the Administra- 
tion is not intending to send us a proposal. But you are saying 
today you want to work with us on developing a proposal? 

Mr. Stephan. Yes, sir, but a proposal based upon the regulatory 
principles and framework that our technology permits. 

Senator Lieberman. Understood. My time is up. But I do want 
to say finally that there has been some attempt to deal with this 
problem of chemical plant security in the Environment Committee. 
Unfortunately, it has been gridlocked. There, the focus was natu- 
rally on the environmental consequences of chemical security. 
Here, we are focused on homeland security. But there is an over- 
lap, naturally. 

And I do think that — with all respect, because I am on that Com- 
mittee, too — I think Senator Collins and I begin with a strong non- 
partisan interest, from a homeland security point of view, in get- 
ting something done. 

So I welcome what you have said today. And again, I look for- 
ward to working with you, with a real sense of urgency, to get 
something done to protect the American people as soon as possible. 
Thank you. 

Chairman CoLLiNS. Thank you. Senator Chafee. 

OPENING STATEMENT OF SENATOR CHAFEE 

Senator Chafee. Well, thank you. Madam Chairman. And as 
Senator Lieberman said, we worked on the Environment and Pub- 
lic Works Committee — Senator Lautenberg, Senator Carper, and 
Senator Corzine — all working on trying to get some compromises 
on the environmental issues. And it was difficult. I think we got 
hung up on inherent safer technologies. 

But now as we go forward I am questioning, as Senator 
Lieberman did, on the voluntary aspects, as it exists now. And if 
I understand correctly, 20 percent are not participating, high-risk. 
And is there a cost to those companies that are participating, the 
80 percent that are participating, that give an unfair advantage to 
those that are not. Colonel? 

Mr. Stephan. Sir, I am not quite sure I understand the question. 
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Senator Chafee. If I heard your answer correctly, 20 percent 
under the voluntary scenario are not participating in undergoing — 
introducing safer measures. Do I hear that right? 

Mr. Stephan. That is correct. 

Senator Chafee. And so there must he a cost advantage to them. 
And that is my question. Those companies, the 80 percent that are 
participating, are incurring costs that the other companies are not 
incurring; and thus there is an unfair advantage. Does that mean 
we should enact legislation, considering that there is unfair advan- 
tage, those companies that are not incurring these costs? 

Mr. Stephan. OK, sir, thank you. Again, I am not an industry 
expert on this topic. And I would defer any real granular answer 
back to you to one of the industry associations, itself 

But to my understanding, most of the capacity that we are wor- 
ried about that would be high-risk that does not fall within the vol- 
untary regime constitute or are represented by mid-sized to smaller 
companies that still have very considerable amounts of chemicals 
or types of chemicals onboard their sites that would cause us to 
place them in the high-risk category. Therefore, the profit margins 
there are something that are a very serious concern to that aspect 
of the industry. 

Having said that, I think that we can, with the risk assessment 
methodologies and tools that we have come up with now, work out 
some solutions that are facilities-based, as opposed to sector-based, 
that would bring down the same thing across the board at every 
single facility. 

I think we are better now. We are able to make better and more 
informed judgments. And we could adjust the security framework 
based upon risk and based upon a menu of options that would meet 
a certain criteria that these companies would be allowed to pick 
from; hopefully, some solutions are more cost effective than others. 

Senator Chafee. Well, once again, we worked hard on the EPW 
Committee, and look forward to working with you here to get some 
fair legislation. Thank you. 

Chairman COLLINS. Thank you. Senator Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator Carper. Thanks, Madam Chairman. It is sort of ironic — 
I will follow up on what Senator Chafee was saying — that four of 
the five Members that are here today are folks who also serve on 
Environment and Public Works. And we have worked in these vine- 
yards a little bit earlier. And I think one of the reasons why most 
of the folks that are here today are from EPW is because of our 
familiarity with these issues and our interest in these issues. 

I am from Delaware; Senator Lautenberg over here, is from New 
Jersey. Chemical facilities and the products that they produce are 
important to my State and, obviously, to his. I understand our new 
Secretary, Secretary Chertoff, is actually from New Jersey. And I 
just was kind of wondering out loud — and you do not have to an- 
swer this question — ^but maybe one of the reasons why there is 
some renewed interest or some stronger interest in this issue, in 
trying to work with us to find a path forward, might be because — 
what’s the old saying — all politics is local, and he comes from a 
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State where these issues are important. And they have even more 
chemical plants in New Jersey than we do in Delaware. 

And we know that in our State an incident at a chemical plant 
can he devastating. We know that we are vulnerable to some extent 
in our State and other States, as well — prohahly, all States, if you 
have got 15,000 chemical plants out there; prohahly covers just 
about everybody. And it is important for us, I think, to not wait 
for the terrorists to show us that we need to do more. 

The first question I want to ask just to the two of you, how long 
have you all been working together on these issues? Is this a new 
partnership? Is this something that you all have been working on 
for a couple of years? Is this the first time you have met? 

Mr. Dunne. Well, we have been working together on the Na- 
tional Response Plan and National Incident Management System 
for going on 3 years. And in terms of this subject matter. Bob is 
relatively new to it, but our office has been involved in it for 3 
years, since it was discussed at EPA back at that time. 

Mr. Stephan. That’s right. We have been working together with 
the EPA since the Department’s existence. And with the issuance 
of HSPD-7, they are the sector lead for the water sector and all 
things security-wise associated with the water sector. We have a 
good partnership; a partnership, a framework, that was nurtured 
in fact during our joint work on the National Incident Management 
System and the National Response Plan. So I think it has been a 
great and effective partnership. And we play off each other’s au- 
thorities and strengths in order to tackle problems jointly. 

In terms of the comments that you made earlier, I just want to 
emphasize that the President has focused us, through HSPD-7, on 
the sectors that are of highest risk to the Nation in terms of public 
health and safety, economic consequences, and the like. And be- 
cause of the chemical sector’s potential to be used as a weapon of 
mass destruction or weapon of mass effects under certain scenarios, 
that is clearly specified or called out in the President’s guidance to 
us. 

And in terms of Secretary Chertoffs State of residence, he rep- 
resents very well the great State of New Jersey, but the man is 
risk-based in everything I have seen him do since he has taken of- 
fice. And I think that is the right approach for this time. And I am 
just happy that the technology that we now have at our fingertips 
is able to basically facilitate or enable the furtherance of that ap- 
proach. 

Senator Carper. The title of today’s hearing is “Is the Federal 
Government Doing Enough To Secure Chemical Facilities and Is 
More Authority Needed?” And let me just ask each of you, just 
without a lot of jargon, just as plainspoken as you can be, just an- 
swer that question for me. I will say it again: Is the Federal Gov- 
ernment Doing Enough To Secure Chemical Facilities and Is More 
Authority Needed? Just very plainspoken. 

Mr. Stephan. Yes, sir. I’ll say absolutely, no one is ever doing 
enough when it comes to critical infrastructures. That is as 
plainspoken as I can get. But I will say we have made important 
advancements. And the newspaper accounts that I read and the 
pronouncements from academics and others that say we have done 
nothing is absolutely the farthest possible thing from the truth that 
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I can envision, based upon going over this in considerable depth 
with my team since I assumed this position. 

We are working with the industry. We are doing risk assess- 
ments. We partner developed the methodology that is going to 
guide us both to the future; set up information-sharing mechanisms 
that work 

Senator Carper. This is important to us. It is important to our 
States and to our country. So what I hope flows out of here is the 
opportunity for us to work with Senator Collins and Senator 
Lieberman. And we are pretty good in this Committee working 
across the aisle, and have got great leadership. 

Mr. Stephan. Yes, sir. 

Senator Carper. And we just want to be able to work with you. 
My view — and this is just the way I look at it — you all have a lot 
to say grace over, since the Department was created. And you must 
feel like a lot of days you have been drinking out of a fire hydrant 
in the last several years; probably still feel that way some days. 

So there is a lot for you to focus on. You now have a chance to 
focus on this. And we just want to work with you to get the job 
done and to make our communities and our chemical facilities 
safer. 

Mr. Stephan. OK. 

Senator Carper. I will go back and restate the title of the hear- 
ing: Is the Federal Government Doing Enough To Secure Chemical 
Facilities and Is More Authority Needed? Let’s focus on the second 
half of that, “And Is More Authority Needed?” 

Mr. Stephan. Yes, sir. Doing a lot; need to do more. And more 
authority is clearly needed. 

Senator Carper. And give us some idea what context, what for- 
mat authority might take. 

Mr. Stephan. What we would like to do is work in partnership, 
again, with you all, to figure out what the right mix is for this sec- 
tor, based on some key principles; that we use a risk-based ap- 
proach to setting up this regulatory framework that takes indi- 
vidual facilities into consideration, so that we do not attempt to put 
a cookie cutter in place and expect that is going to do the job for 
us in any sense. 

We are better than we were 2 years ago. We have the technology 
to help us inform that structure. We want to make sure what we 
put in place is equitable, fair, takes into account responsible invest- 
ments that have been made. But at the end of the day, it has to 
be effective and it has to be measurable. 

But it also cannot be the same. Because one important aspect 
that we all are concerned about, if we put a detailed reg out that 
says, “Every chemical facility will approach it in this manner, 
using the following steps,” I do not know a better cookbook to give 
to al Qaeda than that outlines exactly the level of security by facil- 
ity across the country. We have to be very careful we do not do 
that; and allow a menu of options to be selected flexibly, as long 
as they are measurable, effective, and get the job done. 

Senator Carper. Mr. Dunne, do you want to jump in here? 

Mr. Dunne. Well, I would agree with Bob that authority is need- 
ed. But I do think the knowledge base in the last 2 V 2 years has 
grown appreciably, much more than when we were thinking about 
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the program before DHS became a reality. And I think they have 
developed tools that certainly were not at our disposal back when 
we were looking at the project at EPA. So I would support what 
he said in terms of authority. 

And coming from a regulatory agency, one of our problems with 
regulatory programs is trying to fit everything under one big regu- 
lation. And it is a problem. And as you know, Senator, our RMP 
plans are available to the public under community right to know, 
but there is certain information 

Senator Carper. I’m sorry, say it again. What plans are avail- 
able? 

Mr. Dunne. The management plans on this Clean Air Act, under 
Section 112(r). But there are also consequences, which only can be 
seen in reading rooms. And there are 50 reading rooms. I think we 
have got to be careful about how much we provide outside of the 
realm of the facility and the law enforcement people and the Fed- 
eral Government officials. I think there is a real danger of having 
plans floating around, where any terrorist, or almost any ama- 
teur — it doesn’t have to be a professional terrorist — can get their 
hands on information. So I think it has to be a thoughtful ap- 
proach. 

And I would agree that coming up here at a public hearing, if 
we did have the answer, what should go in the legislation, ought 
to be really thought out in terms of what are we doing to protect 
the American public and what are we doing to make sure the secu- 
rity of the country is being held that we are not aiding and abet- 
ting enemies. 

Senator Carper. All right, good. My time has expired. Madam 
Chairman, thanks very much. 

Chairman COLLINS. Thank you. Senator Lautenberg. 

OPENIN STATEMENT OF SENATOR LAUTENBERG 

Senator Lautenberg. Thank you. Madam Chairman, for con- 
vening this hearing as you have. It has been too long since we have 
had the horrible experience that has shaken our resolve and our 
comfort in that we are doing whatever we should to protect our 
people from assault. And Madam Chairman, I ask unanimous con- 
sent that my opening statement be included in the record. 

Chairman COLLINS. Without objection. 

[The prepared statement of Senator Lautenberg follows:] 

PREPARED STATEMENT OF SENATOR LAUTENBERG 

Madam Chairman, thank you for convening this hearing on this critical topic. 

My concern about the security of chemical plants dates back to the late 1990’s. 
It’s now 2005 and time to stop talking and start acting to confront the terrible risks 
that have not diminished since September 11. 

New Jersey has some 1,600 chemical facilities within its borders — not one of 
which is now legally required to take any of the risk-reduction steps identified by 
the experts in our last hearing. 

Today, I want to hear what the Department of Homeland Security has accom- 
plished in the last 30 months to protect our children and our families. 

The GAO tells us that between 10 and 100 million Americans live in a vulnerable 
zone of potential sickness and death. 

The Congressional Research Service has calculated that more than 8,000 schools, 
or hospitals, or both, are near one of the nation’s chemical facilities. 

In the wake of September 11, we can not any longer afford to keep talking about 
these risks — it is time for action. 
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The 9/11 Commission cautioned that we must not focus so much on the last attack 
that we miss the next attack to strike our country. 

I’m afraid we have failed to absorb that lesson as well as we should. 

And chemical plant security is one of the most glaring examples of that failure. 

There are about 15,000 chemical facilities in the country. More than half of them 
are located near our families, where our children and grandchildren live and play. 
More than one thousand human beings could be killed. 

For example, according to EPA the largest “zone of vulnerability” to wide-spread 
death and injury is in South Kearney, New Jersey where twelve million people live. 

Mr. Chairman, the attacks of September 11 were devastating. My State lost 700 
of our friends, neighbors and loved ones that day. We all hope that we never see 
the like of it again. 

But the fact is, a terrorist attack on a chemical facility could be even worse. 

And by ignoring the threat, we might be inviting such an attack, because ter- 
rorism experts say our enemies like to focus on poorly secured “soft” targets. 

I would urge my colleagues on the Committee, who I know are very committed 
to this issue, to move forward from this hearing toward a legislative remedy. 

I thank all the witnesses who are with us today, and I look forward to hearing 
their views on this crucial issue. 

Senator Lautenberg. I thank you for that. 

Mr. Stephan — and I thank you hoth for your testimony — in light 
of the announcement this morning that we have seen in the paper 
and the news that the Bush Administration is now endorsing man- 
datory requirements for increased security at chemical plants, have 
you looked at the Corzine hill, my colleague’s hill, in terms of what 
he would like to see done with the Chemical Hazards Board, the 
management of these facilities, to hotter conform to our security 
needs? Have you looked at that? 

Mr. Stephan. Sir, in developing this framework — and again, I 
want to emphasize that this is not a new approach. The policy has 
always been that we are willing to partner with Congress to figure 
out the right legislative solution to fix some gaps across this sector. 
I, personally, have not gotten in depth into any of the previous 
amendments or potential pieces of legislation that have come for- 
ward, being new to this. But I can assure you that as we take a 
look at working together to develop what is the right regulatory 
framework for this sector, that we need to consider all things that 
have previously been on the table, and measure them against the 
baseline criteria 

Senator Lautenberg. Yes, well, not meaning to cut you short, 
but it is an important proposal, as are some others that are there. 
And I would hope that DHS would take a prompt and thorough 
look at these things, to give us their view on what we ought to be 
doing. 

Mr. Dunne, there is a significant difference between the figures 
that the EPA lists as facilities that need attention and DHS. EPA 
reports that there are 110 facilities where an explosion could harm 
a million people. And I am not sure I caught the nuance that you 
were trying to bring here. 

The focus is only perhaps on those places where a million people 
could be injured as a result of an accident or a terrorist attack, ob- 
viously? DHS reports that there are 300 facilities — far larger num- 
ber — where an explosion could harm about 50,000 people. 

Now, where do you draw the line on these data? Are we con- 
cerned about quantity of those at risk? Because I mean, if 500 peo- 
ple were to die from a chemical attack or an accident, we would 
be up in arms about it. We would be turning loose all of our facili- 
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ties to do something with that. What do you see is the explanation 
for the difference? 

Mr. Dunne. Well, I am not too sure we really differ. The 123, or 
now 110 — may be somewhat out of context. It is a hypothetical, an- 
alytical modeling tool that was used to develop that. It isn’t saying, 
in effect, that if you happen to be one of a million people around 
a facility that you are going to be affected. It is potentially that. 
And it shouldn’t be taken out of that context. 

I think what DHS has done, as they have gotten sophisticated 
and learned more and more about the tools is try to isolate those 
facilities that are considered the most vulnerable, based on what 
is there in terms of the quantity and the type of chemical, and also 
in terms of the surrounding area in terms of the population. I think 
there are some similarities, and there obviously is some overlap. 

Senator Lautenberg. But Mr. Dunne, we are dealing here with 
huge numbers of people. And whether the effect is kind of periph- 
eral or whether it is lethal, I mean, we have an obligation to do 
what we can. 

I consider — and I have said this publicly many times — that the 
front in this war that we are in in Iraq extends all the way across 
America. I believe that is where the front is. And we do not spend 
anywhere near the amount of money protecting our citizens on 
American soil that we do trying to help Iraq correct its problems 
and to protect our service people over there. 

So I am not sure where the defining line is that says, “Well, this 
deserves attention.” I think they all deserve attention. I am author 
of the Right-To-Know law. The Right-To-Know law carries virtually 
no penalties; but it has had enormous conformity by private indus- 
try. And we have reduced toxic emissions by 40 percent across this 
country as a result of that. 

But this goes way beyond that kind of thing. And I think it is 
agreed, is it not — and I ask both you and Mr. Stephan — that sanc- 
tions are in order, in order to get people to conform to the need to 
alert the public to what it is that they are carrying, what the possi- 
bility is if there is an accident or an attack. 

Aren’t we at a different point in time, in terms of trying to split 
hairs about whether or not 50,000 people is a reasonable size mar- 
ket to protect? Or might it be 500 people? The million-person num- 
ber is so devastating it is almost unimaginable, but New Jersey 
has a facility identified as a place where 12 million people could 
lose their lives. But to any one of those families, or to someone who 
lost someone in Oklahoma, the devastation is beyond comprehen- 
sion. So where do we go with these numbers that you have put out 
here? 

Mr. Dunne. I am not too sure what you mean, where we are 
going. We have 15,000 facilities and 

Senator Lautenberg. Well, I will tell you where we are going. 
I will tell you directly where we go. There is a huge difference in 
the numbers between the two parties. I would like you to explain, 
tell me why their’s is wrong. Their’s says we have to talk about 300 
facilities; and as I hear you, well, it is not 123, it is 110. Just ex- 
plain your numbers a little more. 
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Mr. Dunne. Well, I do not think that we have a different ap- 
proach. I am not too sure our numbers are different. A 123 to 110 
is just a fact, in terms of what we receive in reports. 

Senator Lautenberg. They are saying 300. 

Mr. Dunne. Well, ours was not based on anything more than the 
population around facilities or covered under the RMP. And I think 
what they are talking about is completely different in terms of how 
you size a program up in terms of where you go first in terms of 
vulnerability that creates potentially the biggest problem. I do not 
think there is any difference. Senator. 

Senator Lautenberg. Help me. Colonel Stephan. Do you see any 
difference between your 300 identified facilities where an explosion 
could harm about 50,000 people, and EPA’s, where they say there 
are 110 facilities where an explosion could harm a million people? 
Are we saying that 50 is a good place to start, or do we only look 
at places where a million people could be harmed? 

Mr. Stephan. No, sir. Well, every human life is important, but 
numbers mean different things to different people. What the EPA 
numbers mean to them is, based upon this point on the map that 
represents the geographic center of this production site, for exam- 
ple, based upon the most toxic chemical onboard that site at a 
threshold quantity, there is a ring drawn around that site “X”-num- 
ber of miles out from the center. 

What that 12 million figure represents, not 12 million deaths; 12 
million people that could somehow be affected, depending on wind 
direction, wind speed, atmospheric factors that have to be taken 
into account from a safety or planning perspective. The State-level 
councils, the local-level councils, the emergency responder aware- 
ness, the safety issues, the gearage, all of that factors into that. 
And that is what they have to be concerned about. 

What I have to be concerned about is taking those baseline num- 
bers that we get from the EPA — and we agree on the baseline num- 
bers — and I have got to drill down further, because 12 million peo- 
ple are not going to die if that one chemical plant is affected. We 
have to use a more sophisticated approach, based on plume mod- 
eling, wind direction, wind speed, atmospheric conditions, so on 
and so forth, to drill down on that aggregate number of 12 million. 

And when you do that, you get to a significantly less percentage 
of the population that would result in actual fatalities or be af- 
fected in some way, demonstrating visible signs of being affected by 
the chemical agent. 

So we worry about that, in terms of our risk-based metrics, on 
where to drill down, how to come up with the numbers that we 
have. They have to be more over-arching in nature, because every- 
body inside that circle — the law enforcement guys, the firemen, the 
emergency management folks — have to go through training aware- 
ness and be equipped so that they can respond in case the wind 
just happens to unluckily blow in their direction on that day. 

Senator Lautenberg. Madam Chairman, I hope the record will 
be kept open for questions, because we obviously have disparity 
here that leaves me, at least, kind of scratching my head and say- 
ing, “I don’t get it.” Thank you. 

Chairman COLLINS. Thank you. Senator. Actually, with Senator 
Akaka’s indulgence, I was going to ask Colonel Stephan to conclude 
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the answer to my question, which speaks to this very issue. But if 
the Senator is on a tight time frame, then I will go directly to you. 

Senator Akaka. I would appreciate that. 

Chairman CoLLiNS. Go right ahead. Senator. Then we will come 
back to my question. 

OPENING STATEMENT OF SENATOR AKAKA 

Senator Akaka. Thank you very much. Madam Chairman. I 
thank you so much for holding this hearing. You all know that this 
follows the recent chemical security hearing we have had. At that 
hearing, we learned that the United States has a great deal of 
work ahead to strengthen and ensure the security of the chemical 
sector in the post-September 11 environment. 

And all the witnesses that testified, testified that the voluntary 
efforts to secure the chemical industry are insufficient, and so we 
are having this hearing. And they advocated at that time for more 
Federal regulation of the chemical industry. 

I would like to welcome our witnesses. I had another commit- 
ment, Madam Chairman, this morning, and I regret that I was not 
able to hear the witnesses’ testimony. And I ask that my full state- 
ment be placed in the record. 

Chairman COLLINS. Without objection. 

[The prepared statement of Senator Akaka follows:] 

PREPARED STATEMENT OF SENATOR AKAKA 

Madam Chairman, thank you for holding this hearing. I would like to add my wel- 
come to our distinguished witnesses from the Department of Homeland Security 
(DHS) and the Environmental Protection Agency (EPA). 

At our recent chemical security hearing, we learned that the United States has 
a great deal of work ahead to strengthen and ensure the security of the chemical 
sector in the post-September 11 environment. All the witnesses at the last hearing 
testified that the current, voluntary efforts to secure the chemical industry are in- 
sufficient. They advocated for more Federal regulation of the chemical industry. 
Given the potential economic consequences and lives that could be lost as a result 
of an attack on our chemical facilities, I believe that we need to consider giving DHS 
greater authority to regulate the chemical industry. However, we must move for- 
ward carefully and ensure that the Department is given the necessary tools to un- 
dertake this new challenge. 

I am concerned that the proposals from the last hearing lacked adequate analysis 
of the human, financial, and organizational resources required to regulate an indus- 
try. Dr. Richard Falkenrath, The Brookings Institution, proposed that DHS be re- 
sponsible for promulgating regulations, certifying companies, verifying the certifi- 
cation, enforcing compliance, and offering an appeals process. If this were to occur, 
how would the Department be reorganized and how many additional personnel 
would be required? 

It was suggested by Dr. Stephen Flynn, Council on Foreign Relations, that the 
Department use contractors to execute many of these new responsibilities. As a 
longstanding supporter of the Federal civil service, this suggestion troubles me. His 
proposal would contribute to a growing trend at DHS: More and more critical posi- 
tions being contracted out, while the government is losing the opportunity to de- 
velop institutional knowledge and a cadre of skilled and dedicated employees. For 
the same reason that passenger and baggage screening was federalized after Sep- 
tember 11, I question whether it is advisable to have contractors enforcing Federal 
regulations in the chemical sector. 

Furthermore, the EPA has a special expertise in the chemical sector from which 
DHS should draw upon. Some fear greater EPA involvement in chemical security 
regulation could lead to more environmental and safety scrutiny of the chemical in- 
dustry. But I think it is wrong to preclude the involvement of EPA. 

For these reasons, I urge my colleagues on this Committee, many of whom have 
spent the past few years committed to building and improving DHS, to examine 
thoroughly how regulation will be implemented and what would be required of DHS. 
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Madam Chairman, I welcome this opportunity to explore these issues in greater 
detail. I look forward to the testimony of our witnesses. 

Senator Akaka. Under Secretary Stephan, I would like to follow 
up on an issue raised by Senator Collins in her opening statement. 
At the April 27 hearing, two of the witnesses proposed granting 
DHS extensive chemical security regulatory authority that would 
include promulgating regulations, certifying facilities, verifying the 
certification, and enforcing compliance. 

Under Secretary Stephan, I understand that DHS has not spe- 
cifically asked for such authority. However, if Congress mandates 
that DHS regulate chemical security in the manner I just de- 
scribed, what financial and human resources will the Department 
need? And in answering this, I ask you to be as specific as possible. 

Mr. Stephan. Yes, sir. Thank you for that question. I believe 
that I do not have good numbers associated with a sweeping, over- 
arching, very tightly restrictive, all-encompassing regulatory frame- 
work. I do not have precise numbers for you, because that has not 
been our approach up to this point. I just know those numbers 
would be very significant. 

That is one of the reasons we are coming to Congress, to work 
in partnership, to look at assembling a regulatory framework that 
is risk-based, so that we do not have to apply the exact same 
standards across the board pertinent to every facility, with no other 
consideration. 

What we have to do is implement a regime, I think, that is risk- 
based, is measured, gets the effectiveness and the efficiencies that 
we are looking for in a measurable, reportable manner; that treats 
individual facilities based on risk differently, based upon a common 
approach; but to allow a menu of options based on standards that 
we would promulgate and allow the facility owners and operators 
different ways to get at that problem. 

In this kind of regime, I think we could perform the regulatory 
function without a great influx of new people, new government em- 
ployees, if we adopt this measured approach. We are adopting the 
measured approach not because the numbers are bigger or smaller 
in terms of government employees, but we think it is the right ap- 
proach. The right approach, coincidentally, I think will drive us to 
a smaller number of Federal employees as a requirement. 

Senator Akaka. Mr. Secretary, to answer my question specifi- 
cally, I would ask you to provide us with those numbers that you 
do not have now, for the record. 

Mr. Stephan. Yes, sir. We will go back and provide you an an- 
swer. 

Senator Akaka. Secretary, if DHS is given regulatory authority 
over chemical security, should the regulating office be part of the 
Office of Infrastructure Protection, or separate? And if separate, do 
you think its director should be Senate confirmed? 

Mr. Stephan. Well, that is an interesting set of questions, there. 
So let me answer that in this way. I think that the responsibility 
for the critical infrastructure protection rests within the informa- 
tion analysis and infrastructure protection component of the De- 
partment. I believe that that responsibility should squarely rest 
within that component. 
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Due to the wisdom of the people that came together to create the 
Homeland Security Act, my position is not Senate confirmable. And 
I would not like to have anyone working for me that has a more 
stringent requirement that do not have to meet. So that would be 
my answer back on that point. 

Senator Akaka. Secretary, I am concerned about a trend at DHS 
of relying on private contractors to fill critical functions within the 
Department. For example, I understand that the new domestic Nu- 
clear Detection Office will be run almost entirely by contractors. 
My question to you is, would you expect chemical security regula- 
tion to be executed by career employees, or contractors? And what 
role would you see contractors playing? 

Mr. Stephan. Sir, in terms of the manpower and the subject 
matter expertise necessary to execute that mission, absolutely no 
exceptions, the program management responsibilities should rest 
with a government employee, under all circumstances. That is the 
way the Federal Government operates. That is the way we assure 
accountability and measurable progress across what we do. 

Not to say that there need to be integrated into this mix appro- 
priately the subject matter expertise that we would need to in 
order to be able to have on our staff the ability to have vulner- 
ability folks, consequence folks, threat-focused individuals, that 
may or may not exist within the Federal family or the government 
family at this point. 

Any use of contractors that we would employ would involve tight 
supervisory controls levied upon them by Federal Government em- 
ployees. 

Senator Akaka. One reason I ask that is that it is critical that 
we are able to keep developments and new ideas within the Fed- 
eral level. And if we had contractors do that, it doesn’t really — it 
is not administered by the Federal Government. 

Deputy Administrator Dunne, the EPA has special expertise in 
the chemical industry, if DHS assumes the responsibility for chem- 
ical security regulation, what role do you think EPA should play? 

Mr. Dunne. Well, I think we would continue in a support role. 
And I appreciate the fact that I think you recognize that you can 
only have one department or agency in charge of this effort. I think 
splitting authorities would be the wrong thing to do. 

And we would provide whatever assistance that is necessary, 
similarly to the way we do in responding to emergencies when 
there is a presidential declaration. We respond on a regular basis 
with whom we have a long working relationship, with FEMA. And 
we would continue to support Bob and his people in terms of any 
efforts in terms of our expertise, which is really in the inside-the- 
gate chemical side of the business; not outside-the-gate. We are not 
security experts. 

Senator Akaka. Does DHS plan to involve EPA, do you think, in 
regulation of the chemical industry? 

Mr. Stephan. The ownership, I believe, of the regulatory authori- 
ties needs to be squarely within one department. That would be the 
Department of Homeland Security. That is not to say that we 
would not need a partnership with the EPA. Because as much as 
people would like to, you can’t completely drive a wedge between 
safety and security concerns. They have to be woven together. 
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And I think we have a great partnership with the EPA. We 
would like to rely upon the solid baseline and safety that they have 
set up through their regulatory structure over the years, and be a 
partner with them to solve this problem. But clearly, the authority 
for security for the chemical sector needs to reside with the Depart- 
ment of Homeland Security. 

Senator Akaka. Thank you very much for your responses. 

Madam Chairman, I thank you for being so generous and letting 
me go forward. And I will submit my other questions for the record. 

Chairman COLLINS. Thank you very much. Senator. 

Colonel, I want to get back to the numbers issue. I am very 
aware that the EPA uses a different methodology than DHS. But 
as Senator Lautenberg’s questions, and mine, have shown, there is 
confusion over how we get from the 15,000 high-risk facilities iden- 
tified by the EPA to the 3,400 facilities identified by DHS. 

And I think because many of the legislative proposals that we 
are going to consider are likely to have a tiered approach to regula- 
tion, it is important to understand how we define the highest-risk 
facilities. So, if you could, explain to the Committee how DHS took 
the 15,000 RMP facilities list, with which it is my understanding 
you started, and narrowed it down to the 3,400 facilities. I am not 
critical of the narrowing down. I just need to understand it. 

Mr. Stephan. And let me provide to you as much clarity as a po- 
litical science major can provide in the math issue area, here. 

Working from that initial list of 15,000 that has been the base- 
line that both the EPA and the Department of Homeland Security 
have used, did an initial chop on that list. From that initial chop, 
approximately 2,000 entries were struck because they were redun- 
dant. For example, one particular facility on the list actually ap- 
peared twice; once for its fluorine content on-site, and once for its 
sulphur dioxide content. So we had several facilities that were list- 
ed several times, and we boiled that down simply by eliminating 
the redundant entries. 

Then, another 3,000, generally, were struck from the list because 
they were no longer RMP-applicable, under the EPA meaning of 
that term. Specifically, they had gone out of business; they were a 
tenant plant on a larger site whose host organism or entity had 
been reported in as part of the reporting requirements; they were 
part of a joint venture and both partners reported them acciden- 
tally; or they had reduced chemical holdings on-site below the 
threshold required by the EPA. 

So as we are now winnowing down, based upon redundancies and 
based on facilities that no longer met the EPA requirement, we 
come out through another winnowing window. 

There were another 8,000 on the list of these sites that we be- 
lieve are under somebody else’s existing regulatory framework with 
the security component. For example, 4,000 water facilities that are 
under, in the President’s structural organization of the CIP mission 
area, the EPA’s responsibility, using the Bioterrorism Act, the Safe 
Drinking Water Act; allows them authorities to demand vulner- 
ability assessments, takes some protective measures, so on and so 
forth. 

When we boiled all of those out, that got us down to about the 
3,400 list of things that we consider to be high risk, that fell within 
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no one else’s regulatory purview, so that we could drill down and 
focus on those as kind of a nexus of our initial concern. 

As we work with you to build this regulatory framework, the 
very first thing we are going to have to do is come to an adequate 
agreed-upon definition of what the chemical sector actually is; be- 
cause without that, we will be going all over the place. Because I 
think — there are actually, if you put the whole world of anything 
that has a bottle of chemicals on it somewhere in the United States 
of America, I think there are about 66,000 of those things out 
there. 

So we have to be very careful that we drill down; figure out what 
needs to be inside this regime, what is adequately being taken care 
of under another regulatory framework, as long as that framework 
is risk-based. So we are going to have to work up-front to build in 
the definitional pieces of this. 

Chairman COLLINS. Thank you. That explanation was very clear 
and very helpful. There is another numbers issue on which I want 
to make sure we have clarity. In your testimony, you referred to 
the 20 percent gap. These are chemical facilities that are not ad- 
hering to voluntary industry codes, and we do not know much 
about them as far as their security. But it is my understanding 
that you are talking about 20 percent of the high-risk pool. Is that 
correct? 

Mr. Stephan. That is correct. 

Chairman COLLINS. And this is an important point, because it is 
my understanding that out of the 15,000 high-risk facilities that 
the EPA has identified, only about 1,000 facilities adhere to the 
voluntary codes. Is that accurate? 

Mr. Stephan. I would have to defer to the EPA on that question. 

Chairman COLLINS. Mr. Dunne. 

Mr. Dunne. I think it is a little bit more than 1,000; but correct, 
about 7 or 8 percent, I think. But there are other associations that 
have similar types of codes, so I would think that maybe it is a cou- 
ple of thousand out of the 15,000 that are following some kind of 
security measure right now. 

Chairman COLLINS. Thank you. That is helpful. Mr. Dunne, at 
the Committee’s last hearing, Carolyn Merritt, who chairs the IJ.S. 
Chemical Safety and Hazard Investigation Board, testified that, 
“Many incidents that the Chemical Safety Board has investigated 
reveal serious gaps in how well companies, emergency responders, 
government authorities, and the public are prepared for a major 
chemical release. These gaps in preparedness leave Americans vul- 
nerable.” She went on to say that, “In her judgment, many commu- 
nities are not even ready for a small chemical release.” Do you 
agree with that assessment? 

Mr. Dunne. Well, I do not know how many cases the lady has 
really looked at. They only investigate a handful of cases after 
there is an accident. I am not too sure how you draw that conclu- 
sion. 

Madam Chairman, there are established by law, under the 
Emergency Planning and Community Right To Know Act, over 
3,900 local emergency planning committees. And they are set up by 
States. They are not mandated by the Federal Government. States 
have got them. And they range from one LEPC a State in a couple 
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of cases, to hundreds in other States. So you have got a real split 
in terms of how this approach is taken by the States. 

We did a survey back in 1999 to see how many of them were 
really active, out of the 3,900. And the conclusion, I believe, was 
about 59 to 60 percent are active. And “active” means a variety of 
things. We can take you down to areas in the country where there 
are processing and refineries right there, and you will see LEPCs 
that are getting money from the industry people to staff and have 
appropriate administrative support; to people in other areas of the 
country where an LEPC may be meeting once a year and having 
discussions. 

I think, in terms of the emergency response community, they are 
getting better and better. There is an enormous effort and a large 
amount of money that has gone into training and exercises and ac- 
quiring protection. 

Are we there? Nowhere near it, I suspect. And I think by and 
large the larger companies are fairly well prepared, from what we 
can understand, at least in the safety, and not talking to the secu- 
rity. And I am sure there are small- or medium-sized firms that are 
the major concern. 

So I can’t really respond directly to her statement, but I can say 
that I am sure we are not well prepared across the board all the 
time. 

Chairman CoLLiNS. Let’s talk about some specifics. I understand 
that the Administration wants to work with this Committee, and 
I very much appreciate that commitment. But let me start by ask- 
ing you about a set of principles that the Administration developed 
in February 2003 to apply to chemical security legislation. 

One principle that the Administration endorsed at that time was 
to require an assessment of each facility’s vulnerability to various 
modes of attack, and strategies to counter the vulnerabilities iden- 
tified. I asked you a question related to this at the beginning of the 
hearing. Does that sound to you like a reasonable requirement to 
include in legislation? 

Mr. Stephan. Madam Chairman — and again, I will have to 
apologize, because I do not have any details that have been vetted 
through my policy framework and approved by Secretary Chertoff 
to bring to you today; but we are working on those in accelerated 
manner. 

As I discussed, however, earlier, there is just a certain set of 
things that would be an appropriate part, or an appropriate portion 
of any framework dealing with security from a regulatory perspec- 
tive. People have got to be doing some kind of sanctioned approach 
to risk assessments. Some people have got to be taking action 
based upon those risk assessments, implementing measures that 
are measurable. And there has to be a system in place to develop 
an auditing or a tracking of all this, and then a compliance piece 
to all of it. 

So I think if I were speaking about the chemical sector or any 
other sector, to get at a regulatory structure it has got to have 
those key components embedded somewhere, somehow. The devil is 
in the details, as you pointed out earlier. 

Chairman COLLINS. But surely, you can’t get to the audit and 
compliance areas unless you have some sort of baseline require- 
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ment for a vulnerability assessment and for the development of 
strategies to counter the vulnerabilities. I mean, that seems to me 
to be so basic to the legislation that I think it is safe for you to 
say “Yes.” [Laughter.] 

Mr. Stephan. Safety is always a concern. But again, I have no 
specific pieces of the framework. I can’t imagine a framework that 
did not include assessing 

Chairman COLLINS. I can’t, either. 

Mr. Dunne [continuing]. Or not necessarily focused on vulner- 
ability, but risk; because we have to take into account con- 
sequences, threat, and vulnerabilities, as part of an overall risk- 
based approach. 

Chairman COLLINS. Well, let me turn to another possible frame- 
work, because we are searching for the right way to do this. Mr. 
Dunne, for example, you brought up the interesting point that we 
do not want to provide a road map to the terrorists. I think that 
is an excellent point that we are going to have to keep in mind. 

Secretary Chertoff has indicated that the framework that was es- 
tablished under the Maritime Transportation Security Act has 
proven highly successful. The MTSA requires the Coast Guard to 
promulgate performance-based regulations and to form area mari- 
time security committees, to designate a Federal maritime security 
coordinator, to complete facility and area maritime security plans, 
compile a list of critical infrastructure in our ports. 

Is that a possible framework for us to look to when it comes to 
regulating chemical security, in your view? 

Mr. Stephan. Yes. And that is absolutely one of the frameworks 
that we are going to consider, because we do think that particular 
way of doing business has achieved a certain level of success. We 
just have to, again, map it against whatever these criteria end up 
being that we can mutually agree upon, and see if there are any 
deltas between the NTSA approach and whatever the overall more 
encompassing approach would be. 

The second bit of interesting news there, though, is the Coast 
Guard appears to have achieved an incredible amount of efficiency 
and acceptance as a regulator. And we would love to model the 
Coast Guard’s approach to dealing with the private sector yet get- 
ting the job done efficiently and effectively. So we want to actually 
sit down with them, and we have in a preliminary sort of way, to 
figure out how they have been able to crack that code. 

Chairman CoLLiNS. I think the Coast Guard is an ideal model 
for us to take a look at, and I certainly agree with you on the ac- 
ceptance and the respect that the public has in dealing with the 
Coast Guard on a lot of port security and maritime interdiction 
issues as well. 

I want to turn to the buffer zone program. It is ironic to me that 
you testified today, as the Secretary frequently has, that we should 
have a completely risk-based approach to funding, but that is not 
really what the buffer zone protection program funding is based on. 
Isn’t it a flat $50,000, with only a 15 percent variance up or down, 
regardless of what the site is? 

Mr. Stephan. Yes, ma’am, that is correct. And right now, the 
buffer zone protection plan scheme of maneuver does have a risk 
component to it; in that it is targeted against what we consider to 
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be the top 272 highest-risk facilities in the chemical sector. So that 
portion of it — in terms of drilling down to who would be eligible, 
who we are going to work with, who we think needs this level of 
focus — that is completely risk-based. 

This first year of its implementation, we basically did the best 
we could, in terms of trying to come up with some equitable way 
to push some quality improvements and capability out the door. I 
think, based upon not having the risk management tool that we 
now are ready to deploy across the sector, that is the best foot for- 
ward we could have put a year ago when we came up — or over a 
year ago when we came up with the idea for this program. 

I think, beginning with the next budget cycle, you will be able 
to see from us a much more measured risk-based approach, simply 
because the technology has now caught up with us. And we want 
to fully employ that in terms of determining criticality against 
which we will base our decisions about where to push the buffer 
zone protection plan grant monies. 

Chairman COLLINS. Mr. Dunne, you gave us one caution as we 
draft this legislation, about spelling out too many requirements 
that might result in plans that were available to the public and 
could be used to cause us harm, to be turned against us. Do you 
have any other cautions for this Committee, as we draft this legis- 
lation? 

Mr. Dunne. Well, when you referred to the principle, that was 
interesting. I would agree that, where necessary, assessments have 
to be done and a plan has got to be done, and it has got to be able 
to be checked. We had discussions back 3 years ago that, if this ei- 
ther was done through our own regulation or we were going to go 
by law, that we were of the belief that the plans and the assess- 
ments and the vulnerability analysis should not leave that facility; 
should stay with the unit there. 

Now, the Water Bioterrorism Act does have the water plans com- 
ing to EPA. It is locked; it is secured. And that has got very limited 
access. Law enforcement and some of the DHS people have some 
access to it, and it is a very limited number of people. 

I think on the security side, in terms of what is being done inside 
that facility, it can be very dangerous unless we protect those 
sources. So I would think that doing the analysis and doing the 
plans on the recovery is really necessary, but limiting the access 
to that information is really necessary. 

Chairman COLLINS. Is that in conflict with the community right- 
to-know law? 

Mr. Dunne. No, actually, the risk management plans under Sec- 
tion 112(r) are available to the public. In fact, we had a long, spir- 
ited debate within the Agency whether or not the executive sum- 
maries ought to be released. After September 11, we decided to 
withhold those. 

We recently have just let those go. But in terms of consequences, 
they are only available in reading rooms in 50 areas, either EPA’s 
offices or the EBI offices. And they are not visited that often. Main- 
ly, I was told today, they are visited more by the press. And they 
are paper copies only, and you can only go in and look at one facil- 
ity at a time, and there is a limited number of times you can. 
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And so we have tried to restrict that information. And actually, 
there was a law passed in 1999 that led us to it. This is not some- 
thing that EPA just dreamt up. There was a security law, and the 
acronym is “SERA.” And we do take a look at whether or not — if 
this got into the wrong hands, could they create harm. And that 
is why we make sure that we adhere to that principle that was put 
in the act in 1999. 

Chairman CoLLiNS. It seems to me that there is a potential ten- 
sion here because, on the one hand, you certainly do not want to 
provide terrorists with information on how to attack a facility and 
what its vulnerabilities are; on the other hand, you do want local 
law enforcement and emergency response officials to understand 
the vulnerabilities in order to improve their preparedness. How do 
we strike the right balance on that? 

Mr. Dunne. Well, no, I do not think there is a conflict in that. 
Actually, under the safety plans, that information is available. Law 
enforcement, fire departments, and other people have to prepare 
outside the gate for emergency response. And that is why the Con- 
gress had the States come up with local emergency planning com- 
mittees. So I do not think there is a conflict. 

There are certain conditions within a facility that, if it became 
known to a person who wanted to create harm, could create havoc 
for us. So I make the distinction in terms of keeping those plans 
inside the gate. But I think the law enforcement community, fire 
people, and the emergency response people should have access, in 
terms of what the vulnerabilities are and what type of activities 
they are going to have to undertake to plan and prepare for a re- 
sponse. 

Chairman COLLINS. Colonel, any advice to us, any cautions, as 
we proceed to draft legislation? 

Mr. Stephan. Ma’am, again, just to restate a few key points, we 
are really looking to do this in a fair and balanced, yet effective 
manner. Because this sector is vitally important to the Nation in 
terms of what it represents to our economy, what it represents to 
the daily lives of Americans across the country. 

By that same token, it is a very important security risk, not only 
because of the economic consequences involved, but the public 
health and safety dimension of all this. That drives us to it. 

We think now we are grown up enough, we are mature enough 
in both our knowledge base, the stuff that the private sector has 
done, and the technologies that we have to use to guide a risk as- 
sessment process. Let’s work together to make sure we put the 
right structure in place, so that we are not crippling — or helping 
al Qaeda and the like by crippling a vital part of our economy 
while trying to secure it. 

I think there is a way we can take a measured, balanced ap- 
proach so that we can close the remaining gaps for that 20 percent 
or so capacity we are worried about; make sure we can sustain the 
good efforts that have been done by industry voluntarily over time; 
and to make sure that those voluntary efforts are achieving the ef- 
fects we want to see. 

And I think there is a way to do that, and we have some really 
smart, gifted, talented people that will help us on our end put 
those principles in motion. And we want to do it on an accelerated 
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track through our policy process, and sit down and work with you 
to see what this means as quickly as we can. 

Chairman COLLINS. Thank you. I want to thank you both for 
your testimony today. We are on an accelerated time-frame for 
completing this legislation. I intend to hold additional hearings, to 
hear from industry groups, homeland security experts, environ- 
mental groups, and others that have an interest in this area. My 
hope then is to use the August recess to complete the drafting of 
a bill, and then introduce it — I hope, with bipartisan support — in 
September. 

I tell you that time-frame because we will need the Administra- 
tion’s assistance and guidance and input very quickly. I am con- 
vinced that legislation is needed. I am very pleased to hear the Ad- 
ministration endorse a legislative goal. But we need your help on 
specifics. We have not talked much about what the legislation 
should contain today. 

So I look forward to continuing our dialogue and to working with 
you on an expedited basis. I want to thank you for your help today. 

This hearing record will remain open for 15 days. I also want to 
thank my staff for all of their work on this important issue. The 
Committee hearing is now adjourned. 

[Whereupon at 12:06 p.m., the Committee was adjourned.] 



APPENDIX 


PREPARED STATEMENT OF SENATOR VOINOVICH 

Chairman Collins, thank you for holding this hearing today. The chemical indus- 
try is a critical component of our Nation’s infrastructure. I complement your atten- 
tion to the security of this industry and I look forward to working with the Members 
of the Committee, the Department of Homeland Security, and the Stakeholder com- 
munity to ensure that our Nation’s chemical sector is secure from the threat of ter- 
rorist attacks. 

As I have previously noted, the chemical industry contributes to our high quality 
of life, whether it be enhanced crop production, improved water chlorination, effec- 
tive household cleaners or advanced life-saving medications. However, these benefits 
do not come without risk. 

During the Committee’s first chemical security hearing on April 27, we heard 
alarming statistics that warned of a devastating loss of life in the event of a ter- 
rorist attack against a major chemical facility. Depending on the severity of the at- 
tack, the statistics ranged from 10,000 to an unfathomable 2.4 million casualties. 

Today, we will hear from both the Environment Protection Agency (EPA) and the 
Department of Homeland Security (DHS). I understand that, since assuming juris- 
diction of chemical industry security, DHS has made significant modifications to 
both the method of risk assessment and the strategy for prevention and protection 
from terrorist attacks. I look forward to obtaining the Department’s risk assessment 
and learning the actions it is taking to mitigate our vulnerabilities. 

However, I believe that the Eederal Government can not protect against every 
threat. Therefore, I want to reiterate my support for a balanced approach between 
self-regulation by industry and more proactive Federal action. Industry leaders, like 
the American Chemistry Council, should be commended for building a strong foun- 
dation for chemical safety. It is my hope that the significant safety measures devel- 
oped by industry will be further built upon and incorporated into our overall chem- 
ical security efforts. 

As we further explore this issue, we must be governed by four guiding principles: 

• First, efforts to enhance the security of our facilities should be sharply fo- 
cused on prevention, protection, and consequence management of potential 
terrorist attacks; 

• Second, Federal action to address chemical vulnerabilities must not be bur- 
dened with extraneous issues that are strictly environmental in nature; 

• Third, critical information must be protected from unnecessary public disclo- 
sure, providing it only to responsible government authorities that need to 
have access to such information; and 

• Fourth, Federal action should adhere to a comprehensive cost-benefit anal- 
ysis, not placing industry at a competitive disadvantage. 

In Ohio, the chemical industry directly employs 48,900 people: The impact of 
these jobs reverberates throughout Ohio, as one job in tbe chemical industry creates 
another 6.2 jobs for the State’s economy. 

The chemical industry is experiencing economic hardship as a result of rising nat- 
ural gas costs. As we move forward in efforts to secure your chemical industry infra- 
structure from a terrorist attack, we must be certain that our efforts do not unwit- 
tingly create onerous Federal regulations that jeopardize the industry’s viability. 

As I have said before, it is not economically feasible to protect everything; doing 
so would bankrupt the Nation. Accordingly, all security enhancements including the 
security of our Nation’s chemical infrastructure should be based, first and foremost, 
on risk and vulnerability. 
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Chairman Collins, thank you for holding this hearing. I look forward to working 
with you on this issue. 


PREPARED STATEMENT OF SENATOR COLEMAN 

I want to thank Chairman Collins and Senator Lieberman for holding this impor- 
tant hearing to examine what the Federal Government is doing to secure chemical 
facilities to determine if more authority is needed. 

Securing the chemical sector is a complex undertaking but vital to protecting our 
homeland. There are literally thousands of chemical facilities that work with large 
quantities of hazardous materials throughout the country and they are located in 
or near major cities as well as rural areas. Minnesota has 20 chemical facilities that 
are considered to be “high-risk” on the National Asset Database and chemical secu- 
rity is of concern to the residents of Minnesota. 

As a result of the 1984 accident at the Lfnion Carbide pesticide plant in Bhophal, 
India, Congress passed the Emergency Planning and Community Right-to-Know 
Act, or EPCRA, to reduce the risk to the general public associated with the acci- 
dental release of hazardous chemicals from chemical facilities by requiring State 
and local governments as well as facility operators to prepare plans for any acci- 
dental releases. In addition to the EPCRA, the Clean Air Act required chemical 
owners and operators to prepare Risk Management Plans, or RMPs to summarize 
the potential threat and worst-case scenario. 

The focus of these laws and requirements were enacted during a different period 
when the Federal Government was rightly concerned with the safety of these facili- 
ties. However, in the post-September 11 world, we have had to create new preven- 
tion and response plans that focus on intentional threats to our critical assets. Al- 
though there is not a uniform standard for securing chemical facilities, it is impor- 
tant to note that the Department of Homeland Security has taken steps to identify 
and prioritize the highest-risk chemical facilities and provide guidance to the owners 
and operators on increasing security in and around their facilities. The chemical in- 
dustry has also made investments in traditional physical security measures and 
many facilities have voluntarily adopted the Responsible Care security recommenda- 
tions of the American Chemistry Council. 

While these efforts have increased security, it is clear much work still remains 
in terms of securing the chemical sector. Instead of security being a cost of doing 
business — it needs to become a way of doing business. And as we move forward, it 
is crucial that Congress, the Administration and the industry work together to en- 
sure that sufficient prevention and response plans are in place at our Nation’s 
chemical facilities. 

I look forward to hearing the testimony of our panelists about the state of security 
in the chemical sector and what additional authority may be necessary to maintain 
or increase that security. 
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Introduction 

Good morning, Chairman Collins, Senator Lieberman and distinguished members of the 
Committee. It is my privilege to come before you today to discuss Department of 
Homeland Security (DHS) efforts to reduce the risk posed to the chemical sector from 
potential terrorist attack, as well as to discuss the way ahead regarding the security of this 
critical infrastructure sector. 

Security of the chemical sector is vitally important: It is a very high priority for DHS to 
reduce the risk from terrorism by implementing collaborative security strategies with 
Federal, State, local, and private sector partners — to protect the nation’s chemical 
infrastructure. 

My discussion with you today will include a focus on the risk landscape associated with 
the chemical sector and important collaborative steps that have been taken to close 
security gaps under the existing voluntary public-private sector partnership framework. I 
note that considerable progress has been made through voluntary efforts, but that further 
progress is required. 

As part of his Second Stage Review of DHS policies, operations and structure, Homeland 
Security Secretary Michael Chertoff tasked his team to review the current state of 
security and ensure that we have the proper tools to address threats facing the chemical 
industry, now and in the future. To that end, we are currently assessing the need for a 
carefully measured, risk-based regulatory regime in this sector. 

Today, I can report on his behalf that Secretary Chertoff has concluded that from the 
regulatory perspective, the existing patchwork of authorities does not permit us to 
regulate the industry effectively. To close the existing gaps and reduce risk across the 
chemical sector, the Federal Government should adhere to certain core principles. 

First, we must recognize that not all facilities present the same level of risk, and that the 
most scrutiny should be focused on those that, if attacked, could endanger the greatest 
number of lives, have the greatest economic impact or present other very significant 
risks. There are certainly many chemical facilities in the United States that pose 
relatively low risk. Second, facility security should be based on reasonable, clear, and 
equitable performance standards. The Department should develop enforceable 
performance standards based on the types and severity of potential risks posed by 
terrorists, and facilities should have the flexibility to select among appropriate site- 
specific security measures that will effectively address those risks. Third, we should 
recognize the progress many responsible companies have made to date. Many companies 
have made significant capital investments in security since 9/1 1 and we should build on 
that progress. 
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This testimony will first speak to the nature of chemical sector vulnerability, and then 
will summarize the significant efforts by DHS and the industry since the September 1 1th 
attacks to improve security for the chemical sector. We will, of course, look forward to 
working with you in the coming weeks on the particulars of proposed legislation. 

What Is the Threat to the Chemical Sector? 

The chemical sector, as with all critical infrastructure, is potentially a target for terrorist 
attack. While we have no specific, credible information indicating an immediate threat to 
the chemical sector, DHS remains concerned about the potential public health and 
economic harm should an attack occur. The chemical sector consists of widely varied 
and distributed facilities. The particular vulnerability of any specific facility obviously 
depends on the type and quantity of chemicals at a site, the physical layout, location of 
sensitive targets, access points, geographic location, and other variables. Therefore each 
facility must have a vulnerability assessment - and a security plan — tailored to its unique 
characteristics. 

DHS has identified five areas as the focus of our primary preparedness work with the 
industry: (1) access and access control; (2) operational security; (3) process control; (4) 
facility systems operations; and (5) local first responder and external response and 
recovery coordination. These preparedness planning variables must be refined with 
reference to potential methods of attack. These include perhaps most importantly: 
insider threats or sabotage; cyber attack; and attacks using explosives or other weaponry. 

DHS has established the Homeland Infrastructure Threat and Risk Analysis Center 
(HITRAC) to develop products to help inform infrastructure owners and operators of any 
threats they may potentially face, as well as to better inform their security planning and 
investment decisions. 

HITRAC is currently working in partnership with industry to develop an updated threat 
assessment for the chemical sector detailing plausible terrorist threats on a sector basis. 
This effort includes available intelligence as well as operational tactics, techniques, and 
procedures derived from study of overseas terrorist operations. 

Federal Government Actions to Reduce Risk in the Chemical Sector 

In December 2003, the President issued Homeland Security Presidential Directive 7 
(HSPD-7), Critical Infrastructure Identification, Prioritization, and Protection, which 
assigned DHS overall responsibility for coordinating the national effort to ensure the 
security of America’s critical infrastructure and key resource sectors. Additionally, 
HSPD-7 requires DHS to develop a sector specific plan for the chemical sector and to 
work with public and private sector partners to implement necessary protective measures 
aimed at reducing the vulnerabilities of this critical infrastructure. Pursuant to the HSPD- 
7 guidelines, DHS has worked to improve the security of the chemical sector. 
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A large number of security visits have been completed and protective measures are being 
implemented for a number of the highest-consequence chemical sites in the United States 
— sites that could potentially affect in excess of 50,000 people if attacked. Most of these 
highest-consequence sites have received numerous visits by DHS technical advisors to 
assess and improve site security. The Department continues to visit other chemical 
facilities on a priority basis in coordination with State Homeland Security and Emergency 
Management officials. State and local law enforcement, and site owners and operators. 

Protective Measures Implemented 

To date, the Federal government has established the following protective measures 
programs: 

• Buffer Zone Protection Plans (BZPPs). BZPPs identify and recommend security 
measures and local law enforcement coordination for the area surrounding a facility, 
or “outside the fence,” making it more difficult to plan or launch an attack. DHS 
trains local law enforcement in assessing buffer zone security and validates BZPPs 
provided by State and local officials. DHS is currently distributing $13.6 million to 
State and local governments in FY05 to develop BZPPs. DHS efforts are intended 
to: 

• Improve the level of deterrence in and around the facility through increased staff 
and community awareness, increased and more efficient police presence, 
improved response time and efficiency, etc. 

• Improve the probability of detection of an attack in planning or in the early 
stages of execution, thereby preventing an attack or reducing the likelihood of 
success. 

• Increase the time and logistical support necessary to execute a successful 
terrorist attack, thereby increasing the likelihood of detection during the 
planning and preparatory phase. 

• Increase the efficacy of both defense and response measures through prior 
planning and coordination. 

• Increase the physical assets available for both defense and emergency response 
in the event of an attack. 

• Site Assistance Visits (SAVs). SAVs are essentially “inside-the-fence” vulnerability 
assessments of critical infi-astructure facilities conducted by DHS in conjunction with 
local law enforcement. SAVs have been conducted at 38 of the highest-consequence 
chemical facilities. An additional 50 SAVs of high-risk chemical facilities are 
planned in FY06. Sites are subject to SAVs for a variety of reasons, including: 

• Determination that the facility is highly consequential, that is, the loss of the 
facility, for any reason, would have significant national or regional economic 
and/or public health effects. 

• Determination that the facility is of such complexity that an SAV would be 
beneficial to a subsequent or concurrent BZPP execution. 

• Determination that the facility is under threat. 
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• Request by the owner/operator of a facility that is sufficiently consequential to 
justify the visit. 

• The facility meets the minimum level of consequentiality, combined with the 
presence of an SAV team in the immediate vicinity, usually performing another 
SAV in the same community. Such visits are performed as an efficiency 
measure. 

• Proximity to a National Security Special Event. 

• The Maritime Transportation Security Act (MTSA) and Port Security Grants. 

Currently, 238 chemical sites fall within the port system as defined by MTSA. Under 
the MTSA requirements, all 238 of these facilities have been required to: assess their 
vulnerabilities using an accepted methodology; determine gaps; plan and implement 
measures to close those gaps; and audit results. These sites also are required to 
develop and implement detailed security plans, which are audited by the United 
States. Coast Guard and the owner/operator. DHS’ Office of Infrastructure Protection 
(IP) has worked closely with the Coast Guard to ensure that the MTSA-approved 
methodology is consistent with the overall IP approach. The effect of this effort has 
been to establish a baseline level of security at these 238 chemical facilities, against 
which the Coast Guard can make specific recommendations for enhanced security. 

Additionally, over the past four years, 287 Port Security Grants have been issued 
under MTSA, totaling over $100 million to facilities that include some of the highest- 
risk chemical facilities nationwide. 

• Facility Security Assessments/Facility Security Plans (FSAs/FSPs). Under 
MTSA, owners of chemical facilities located along waterways are required to 
complete FSAs and FSPs and submit them to the Coast Guard for approval. All 
chemical facilities subject to MTSA are currently operating with approved FSPs and 
the Coast Guard has completed on-site compliance inspections to verify these 
facilities are operating in accordance with their respective FSP. The Coast Guard will 
visit these and all facilities subject to MTSA annually, at a minimum, to ensure 
continued compliance. 

• FBI Chemical Sector Outreach Initiative. The FBI, in coordination with IP, has 
visited more than 220 chemical facilities for the purposes of conducting terrorism 
response training, threat briefings, and counterterrorism awareness training. 

• Tabletop exercises. As part of IP’s Exercise Program, tabletop exercises have been 
conducted at six high-consequence chemical facilities. Additionally, the chemical 
sector was a participant in Exercise TOPOFF 3, from the corporate level to the 
individual facility level. The findings from these exercises are compiled in After 
Action Reports, which serve as a basis for taking corrective actions including 
upgrading security plans and operating procedures, and planning future exercises. 
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Increased Information Sharing 

Without the active participation of the chemical sector, DHS will not succeed in reducing 
the vulnerabilities and risks to the chemical critical infrastructure of the United States. 
DHS and the chemical sector continue to build a strong partnership based on information 
sharing and active collaboration. A number of new programs have been implemented, 
including: 

• Chemical Sector Coordinating Council. Under the National Infrastructure 
Protection Plan (NIPP), DHS and other Federal agencies are working with sector 
asset owner/operators to develop protection plans for the chemical sector as well as 
sector-coordinating mechanisms to ensure collaboration on the identification, 
prioritization, and coordination of sector critical infrastructure protection programs. 
This effort also facilitates the sharing of information concerning physical and cyber 
threats, vulnerabilities, incidents, potential protective measures, and best practices. 

The Chemical Sector Coordinating Council (SCC) was formed voluntarily by 
stakeholders within the chemical sector in May 2004, and currently comprises 
representatives from sixteen key stakeholder associations. The SCC is a single point 
of contact to facilitate organization and coordination of sector policy development, 
infrastructure protection planning, and plan implementation activities, including 
sector-wide planning, development of sector best practices, promulgation of programs 
and plans, development of requirements for effective information sharing, research 
and development, and cross-sector coordination. 

The Chemical SCC is working closely with the Department to draft the nation’s 
strategic vision for a more secure chemical sector. The Chemical Sector-Specific 
Plan, which will be completed by November 2005, is a component of the NIPP and 
will provide a framework for government and private-sector partnership in reducing 
the overall risk of the sector to terrorist attack. 

• Homeland Security Information Network-Chemical (HSIN-Chemical). The 
Chemical SCC also is piloting the Homeland Security Information Network- 
Chemical (HSIN-Chemical) and will actively participate in the vetting of new HSIN- 
Chemical users. HSIN-Chemical is a highly secure, two-way information sharing 
mechanism. It allows private industry users in the chemical sector to receive 
immediate reports of threats to the sector directly from the Homeland Security 
Operations Center and our chemical Sector Specialists. Via the creation of online 
workgroups, industry leaders can collaborate with far flung members of their own 
company or with security managers from other chemical companies to coordinate 
response activities and share information. The HSIN-Chemical pilot program 
completed phase one on June 6, 2005. Phase two will reach beyond the Chemical 
SCC as we enroll security directors from dozens of large and small chemical 
companies, while continuing to make refinements to the system. In phase three, 
HSIN-Chemical will be open to all chemical company employees with a need for 
access to sensitive security information. 
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• Security Guidance to the Private Sector. Based on data gathered from SAVs and 
BZPPs, DHS has developed three types of security guidance documents. 
“Characteristics and Common Vulnerabilities” reports identify the common 
characteristics and vulnerabilities of chemical sites. “Potential Indicators of Terrorist 
Activity” reports provide information on how to detect terrorist activity near critical 
sites. “Protective Measure” reports identify best practices and other protective 
measures for use at specific critical infrastructure/key resources types. These reports 
have been distributed to all State Homeland Security Offices, with guidance to share 
these reports with the owners/operators of critical infrastructure and the law 
enforcement community within each State, as well as Captains of the Port. The 
reports are also being distributed via the Sector Coordinating Council structure of the 
NIPP. I would be happy to share this material with this Committee. 

• National Infrastructure Coordinating Center (NICC). The National Infrastructure 
Coordinating Center (NICC) is a 24/7 operations center focused on the Nation’s 
critical infrastructure. It provides industry an immediate point of entry for reporting 
suspicious incident and threat related information to government. The NICC is a 
component of the Homeland Security Operations Center, but its mission is to work 
with industry to both receive and disseminate threat and incident-related information. 

• Sector Specialists. The Office of Infrastrucmre Protection has Sector Specialists 
working closely with both industry and the intelligence community to improve the 
flow of threat and incident information. The Sector Specialists participate in 
chemical companies’ security exercises and disaster drills; conduct sector outreach; 
ensure the sector receives necessary threat and intelligence related products; and 
inform the Department and the intelligence community of the sector’s infrastructure 
protection actions and concerns. 

Training 

DHS facilitates the provision of various training courses to asset owner/operators, state, 
local, and tribal governments, and local law enforcement agencies responsible for the 
protection of chemical facilities. Such courses include: BZPP Workshops; Terrorism 
Awareness and Prevention Training; Advanced Bomb Technician Training; Surveillance 
Detection; and First Responder/Preventer Training. DHS facilitates this training through 
several mechanisms, including using prepared, contractor delivered training programs 
that have been certified by DHS’ Office of State and Local Government Coordination 
and Preparedness, as well as in-house instruction teams deployed from the Office of 
Infrastructure Protection, which also delivers DHS-certified training. To date, over 200 
participants from the chemical sector have participated in the training courses offered, 
including tabletop exercises with three major chlorine plants. 
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Industry Actions to Reduce Risk in the Chemical Sector 

It also is important to identify work that the chemical sector has done to date, in close 
partnership with DHS. The owners and operators in the chemical sector are voluntarily 
undertaking a variety of security initiatives: 

• Responsible Care Security Code. In 2002, the American Chemistry Council 
(ACC) developed the Responsible Care Security Code (RCSC) to help chemical 
companies achieve continuous improvement in security performance using a risk- 
based approach to: identify, assess, and address vulnerabilities; prevent or mitigate 
incidents; enhance training and response capabilities; and maintain and improve 
relationships with key stakeholders. A component of the RCSC is the requirement for 
independent third-party verification of security improvements and competent 
completion of the Security Vulnerability Assessment. 

In total, 150 chemical companies belong to the ACC, representing approximately 80- 
90 percent of U.S. chemical production by capacity. Implementation of the RCSC is 
mandatory for all ACC members, as well as members of a variety of other chemical 
sector industry associations, including the Synthetic Organic Chemical Manufacturers 
Association and the Chlorine Institute. 

• Examples of Specific Actions. The ACC estimates its members spent $2 billion 
securing their sites in the 15 months following September 1 1* and an additional Sl.l 
billion toward security in 2004, These resources have been used to conduct 
vulnerability assessments, develop security plans and procedures, and make 
investments in physical and cyber security improvements for facilities of concern, 
including: tighter access controls, better surveillance, new process controls and 
equipment, enhanced crisis management and emergency response procedures, better 
information/coraputer security, and more stringent background checks. Similarly, the 
Chlorine Institute formulated a detailed chlorine-specific security regime that was 
made mandatory for all of their members. 

Reducing Risks in the Chemicai Sector 

Under the existing voluntary framework that governs the chemical sector, DHS will 
continue to develop and implement new programs that will allow the Nation to continue 
to make progress toward reducing risk in America’s chemical sector. Programs currently 
in development include: 

• Risk Analysis and Management for Critical Asset Protection (RAMCAP). 

RAMCAP provides chemical sector owners and operators self-assessment tools to 
assess risk at chemical facilities. RAMCAP data will help DHS to prioritize all 
chemical facilities of concern in the United States according to relative consequence, 
vulnerability, and level of threat. Results from RAMCAP assessments will allow 
comparison of assets from across sectors, allowing for better prioritization of national 
critical infrastructure protective efforts and resources. The overarching RAMCAP 
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program will substantially improve information included in the National Asset 
Database, asset prioritization, comparative risk analysis, and owner/operator 
awareness of the vulnerabilities and consequences at their sites. 

• Consultation & Assistance Program (CAP). The CAP program is a new initiative 
being launched in conjunction with several private sector partners, the American 
Chemistry Council, the Chlorine Institute, and the Synthetic Organic Chemical 
Manufacturer Association. Under the CAP program, DHS protective security 
advisors will visit more than 1,000 chemical facilities in FY06. 

Closing Gaps: The Path Forward 

At DHS, a major focus of the past two years has been developing tools for assessing risk 
and working cooperatively with local jurisdictions and companies to implement 
appropriate protective measures. As we further assess the status of the chemical sector’s 
largely voluntary security regime, we also have been evaluating whether or not the 
current scope and level of effort will be sufficient to address remaining gaps and 
emerging threats. In short, while most companies have been eager to cooperate with the 
Department, it has become clear that the entirely voluntary efforts of these companies 
alone will not sufficiently address security for the entire sector. Based upon work done to 
date, however, we now have greater clarity about the tasks ahead, tested tools and a more 
considerable knowledge-base that will help close potential security gaps. 

By exploring all available means to enhance the existing, purely voluntary system , we 
can ensure that: (1 ) all facilities have in place a core base of preparedness; (2) those 
facilities that pose the greatest threat are receiving the more focused attention that a risk- 
based regulatory regime will bring; and (3) that the nation’s approach to chemical sector 
security will be based on reasonable, clear, equitable and enforceable performance 
standards that reflect the diversity of the chemical sector. 

Conclusion 

The effort to counter the threat and mitigate the risk associated with a terrorist attack on 
the Nation’s chemical sector continues to be one of the Department’s most important 
priorities. 

Since September 2001, this Administration has worked in partnership with stakeholders 
to enhance the overall security of the chemical sector. Through a combination of sector 
governance structures, information sharing mechanisms, risk assessment and risk-based 
planning approaches, prograrrunatic initiatives, local law enforcement enhancements, and 
voluntary industry efforts, the chemical sector has demonstrated considerable progress in 
bolstering its aggregate security posture, but further progress is needed. By developing a 
comprehensive, risk-based plan for the chemical sector we expect to close remaining 
security gaps in this vitally important area. 

This concludes my prepared remarks. 1 would be happy to answer any questions you 
may have at this time. 


9 
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Madam Chairwoman and members of the Committee, I am Thomas Dunne, 
Deputy Assistant Administrator of the Office of Solid Waste and Emergency Response 
(OSWER), U.S. Environmental Protection Agency (EPA). I am pleased to be here to 
discuss EPA’s Emergency Response Program and the issue of chemical site security. 

INTRODUCTION 

EPA’s Office of Solid Waste and Emergency Response manages EPA’s response 
to environmental emergencies, EPA’s national planning and preparedness functions, as 
well as development and implementation of Federal regulations to prevent hazardous 
chemical accidents and oil spills. 

In carrying out our emergency response functions, we work closely with EPA’s 
10 regional offices, our Federal agency partners, and state and local authorities to respond 
to major environmental emergencies and to conduct emergency removal actions at oil 
spill and hazardous waste sites. In this capacity, we respond to several hundred major oil 
spills and hazardous chemical releases each year. EPA has more than 200 highly trained 
Federal response officials, known as On Scene Coordinators (OSCs), stationed 
throughout the country, who are ready to quickly respond to release reports. We have two 
specialized Environmental Response Teams and a Radiological Emergency Response 
Team available at all times. We are also in the process of staffing a new National 
Decontamination Team - a cadre of highly specialized and experienced emergency 
responders, engineers and scientists dedicated to providing immediate technical 
decontamination expertise at the scene of a chemical, biological, or radiological attack. 
The events EPA responds to cover a wide range of emergencies, including the anthrax 
attacks that affected Senate office buildings, the collapse of the World Trade Center in 
New York City, a multi-state effort to recover every surviving piece of the Space Shuttle 
Columbia, and many others. 

In addition to managing our field emergency response functions, EPA has also 
partnered with the Department of Homeland Security and other Federal agencies in 
development and implementation of the National Response Plan (NRP), the National 
Incident Management System (NIMS), and the National Infi-astructure Protection Plan 
CNIPP) and to carry out EPA’s responsibilities under those plans. The NRP and NIMS 
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align the old national response system into a more cohesive structure that integrates the 
incident management and emergency response capabilities and resources of Federal, 

State, and local governments into a national framework for domestic incident 
management. The NIPP provides a risk management framework for the coordinated 
protection of our critical infrastructure and key resources. 

Lastly, we are responsible for development and implementation of Federal 
regulations for hazardous chemical inventory reporting under the Emergency Planning 
and Community Right-to-Know Act (EPCRA), emergency release reporting requirements 
contained in the Comprehensive Environmental Response, Compensation and Liability 
Act (CERCLA), oil spill prevention and response planning requirements under the Oil 
Pollution Act (OP A), and chemical accident prevention and mitigation under the Clean 
Air Act (CAA). 

EPCRA AND THE CAA RISK MANAGEMENT PROGRAM 

Congress passed both EPCRA and CAA section 1 12(r), establishing the chemical 
accident prevention program, in response to the December 1984 toxic chemical disaster 
in Bhopal, India, and subsequent chemical accidents that occurred in the United States in 
the mid to late 1980s. EPCRA calls on U.S. states to create State Emergency Response 
Commissions (SERCs) and local communities to form Local Emergency Platming 
Committees (LEPCs) to prepare local emergency response plans for chemical accidents. 
EPCRA also requires chemical facilities to provide LEPCs with information necessary 
for emergency planning, and to submit annual chemical inventory reports and 
information about the facility’s hazardous chemicals to SERCs, LEPCs and local fire 
departments. 

As its name suggests, EPCRA promotes hazard information sharing and 
emergency planning. However, EPCRA does not require facilities to take actions to 
prevent chemical accidents from occurring. Major chemical accidents continued to occur 
in the U.S. throughout the late 1980s, and in 1990 Congress added section 1 12(r) to the 
Clean Air Act (CAA) to address the problem. CAA section 1 12(r) imposes a “general 
duty” on all stationary facilities handling extremely hazardous chemicals to prevent and 
mitigate accidental releases of those chemicals into the air. It also directs EPA to 
promulgate risk management requirements for the subset of facilities having large 
quantities of the most dangerous chemicals. 

In accordance with Congress’ direction, EPA listed 140 chemicals and threshold 
quantities, based on potential harm to human health and the environment in the event of 
an air release. Facilities having a listed chemical present in more than a threshold 
quantity must conduct a hazard assessment, develop and implement an accident 
prevention and emergency response program, analyze the potential consequences of 
worst-case and alternative (less severe) release scenarios, and provide a summary report - 
called a Risk Management Plan, or RMP - to EPA. Approximately 1 5,000 chemical 
facilities are subject to RMP requirements. 
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RMPs contain valuable information about a chemical facility and its hazards. In 
addition to providing the address and physical location of the facility, RMPs report the 
identity and quantity of each regulated chemical on site, information about the measures 
taken by the facility to prevent accidental releases, facility emergency plaiming 
information, the history of significant accidents at the facility over the last five years, and 
the facility’s Offsite Consequence Analysis (OCA) information, which provides the 
facility’s analytical estimate of the potential consequences of hypothetical worst-case and 
alternative release scenarios. EPA maintains a national electronic database of RMPs, 
known as RMP’*Info, which is currently the most comprehensive database of chemical 
facility hazard information in existence. 

Both EPCRA and CAA section 1 12 (r) contribute to facility safety and emergency 
preparedness to reduce the vulnerability of facilities and their communities to terrorist 
attacks. EPCRA’s reporting requirements ensure that communities are made aware of 
hazardous chemicals located in their area, and SERCs and LEPCs established under the 
law help prepare communities to respond to any catastrophic releases of those chemicals. 
The CAA requirement for facilities to assess and address their chemical hazards reduces 
the risk that any unanticipated release will seriously threaten public health and the 
environment. The CAA requirement that facilities have emergency response plans in 
place also helps lessen the potential consequences of any unanticipated release, however 
caused. In addition, the national RMP database created under the CAA has proven to be 
one of the Federal government’s most important sources of information on the risks 
associated with U.S. hazardous chemical facilities. 

Following September 1 1 terrorist attacks, the President initially assigned EPA 
with the responsibility for addressing the security of the chemical and drinking water 
sectors. In that capacity, EPA considered whether it had authority under CAA section 
1 12(r) to require facilities handling extremely hazardous substances to secure themselves 
against terrorist attack. The CAA section 1 12(r) requirements apply to “accidental 
releases” of extremely hazardous substances, and the Act defines “accidental releases” as 
“unanticipated releases” from stationary sources to ambient (or outdoor) air. While an 
argument could be made that concern for "unanticipated releases" might require some 
measures that would diminish the effect of a terrorist attack, EPA concluded that a broad 
interpretation would be subject to significant legal vulnerability. It would be legally 
questionable to conclude that EPA's 1 12 (r) authority can be stretched to mandate that 
facilities install particular types of perimeter fencing, vehicle barriers, armed protection, 
cyber security, anti-sabotage or other security measures specifically designed to defeat 
intentional terrorist attacks. The Agency also recognized that even if the CAA were 
interpreted to reach terrorist-caused releases, it would not address all the ways in which a 
terrorist might attempt to use a chemical facility to harm the public. Because the CAA 
definition of “accidental releases” is limited to outdoor air releases from stationary 
sources, a CAA chemical security program could not reach releases to water, land or 
indoor air, or theft of chemicals from facilities for release elsewhere. In light of these 
legal and policy concerns, EPA decided against interpreting the CAA to require facilities 
subject to section 1 12(r) to protect them against terrorist attack. 
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FEDERAL CHEMICAL SITE SECURITY LEGISLATION 

Two U.S. laws enacted since September 1 1, 2001 mandate security requirements 
for some categories of chemical facilities. The Public Health Security and Bioterrorism 
Preparedness and Response Act of 2002 requires larger community water utilities (many 
of which use large quantities of hazardous chemicals such as chlorine and ammonia) to 
conduct security vulnerability assessments, implement emergency preparedness and 
response plans, and submit the vulnerability assessments to EPA. The Bioterrorism Act 
does not require that utilities make specific security-related improvements. However, 
EPA does have authority under section 1431 of the Safe Drinking Water Act to require a 
water system, or any person, to take any action necessary to address an imminent and 
substantial endangerment to public health as a result of potential or threatened 
contamination of public water systems. Such actions might include requiring a utility or 
a group of utilities to enhance security in response to certain threats to the water supply. 
The Bioterrorism Act also requires EPA to study methods to prevent, detect, and respond 
to terrorist threats to the safety and security of water distribution systems and 
infrastructure. 

A second new law, the Maritime Transportation Security Act (MTSA), requires 
ports, vessels, and port facilities to conduct vulnerability assessments, develop 
transportation security plans, and develop security incident response plans. For chemical 
facilities located within a port, this law requires specific security measures. 

PRIVATE SECTOR EFFORTS 

Since September 1 1, 2001, many hazardous chemical facilities have already made 
significant investments in traditional physical security measures such as perimeter fences 
and lighting, security guards, access controls and the like, as well as measures to improve 
operational security, employee screening, and security of electronic systems. For 
example, shortly after 9/11, one of the first steps taken by the American Chemistry 
Council was to add a new Security Code to the existing Responsible Care program, and 
issue site security guidelines for the U.S. chemical industry. The new Security Code 
requires ACC member companies to conduct a security vulnerability assessment, 
implement security enhancements, and independently verify those enhancements using a 
third-party audit. Other trade associations representing industries that manufacture or use 
hazardous chemicals have also implemented non-regulatory programs to enhance 
security. Some facilities have also taken steps to reduce their level of inherent risk by 
employing safer production technologies or substituting less hazardous chemicals for 
highly toxic chemicals. 

COORDINATION WITH DHS 

After the creation of the Department of Homeland Security (DHS), Homeland 
Security Presidential Directive 7 made DHS the lead agency for interacting with the 
chemical industry and the hazardous materials sector on infrastructure protection issues 
in the chemical sector. At that time, EPA and DHS effected a transition of ongoing 
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Federal chemical security efforts to DHS in a series of meetings between the two 
agencies. DHS is currently the lead Federal agency for chemical sector security, and 
EPA serves in a supporting role by providing information and analytical support as 
requested. 

CONCLUSION 

In closing, the Federal government and the chemical sector have made significant 
progress in improving the security of facilities handling extremely hazardous substances. 
At the same time, only a fraction of U.S. hazardous chemical facilities are currently 
subject to Federal security requirements under the Bioterrorism Act or the MTSA. While 
organizations such as the American Chemistry Council should be recognized for their 
important voluntary efforts, we cannot be sure that every high-risk chemical facility has 
taken voluntary action to secure itself against terrorism. As DHS continues its efforts to 
address chemical site security issues, EPA stands ready to support them in those 
initiatives. 
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Questions For the Record 

Senate Homeland Security and Governmentai Affairs Committee 
“Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?" 

June 15, 2005 

Acting Under Secretary Robert B. Stephan 

Questions for the Record from Senator Nonn Coleman 

1 . Under the Maritime Transportation Security Act (MTSA), 238 chemical sites located in ports 
have been required to assess their vulnerabilities using an accepted methodology; determine 
any gaps; and then plan and implement measures to close those gaps. These sites also are 
required to develop and implement detailed security plans, which are audited by the United 
States Coast Guard and the owner of the chemical plant. You concluded that the effect of 
this effort has been to establish a baseline level of security at these 238 chemical facilities, 
against which the Coast Guard can make specific recommendations for enhanced security. 

• Do you think this system would be an effective model for implementing a baseline level of 
security at chemical facilities around the coimtry? 

Response: MTSA is a useful model, but is specifically tailored to certain type of facilities. 
Namely, those adjacent waterways, or part of a port system, and where the US Coast Guard has 
jurisdiction. 

The MTSA was written as a performance based regulation because of the vast differences that 
exist between facilities. A small facility that processes concrete, for example, is going to have 
different security needs from a large chemical facility that uses large quantities of volatile 
chemicals. The performance based nature of the regulation permits the owners of both facilities to 
assess their security vulnerabilities and develop strategies and security measures to mitigate those 
vulnerabilities appropriately. Because of this approach, the Coast Guard was able to establish a 
baseline level of security for all maritime facilities, including chemical facilities that were required 
to submit Facility Security Plans (FSP) because of their regulated maritime activities. 

Assuming that enabling legislation substantially similar to MTSA, but with broader applicability, 
was enacted, the Department’s preference would be to develop regulations for chemical facilities 
that provide that each regulated chemical facility review their site-specific operations, physical 
plant, and chemical hazards to identify their security vulnerabilities and, then, develop security 
measures to mitigate those identified vulnerabilities. The agency with regulatory authority under 
such a scheme would review the proposed security measures and make a determination of 
adequacy or provide recommendations for enhancements. 

2. As we contemplate the security of the chemical industry, we need to be mindful of the 
positive steps taken by the chemical industry on their own volition to strengthen the security 
of their own facilities as well as the efforts and actions of the Department of Homeland 
Security. 

• Given the actions of DHS and the industry, what additional authorities does DHS believe are 
necessary to enhance their ability to further secure our chemical facilities? 

Response: The Department believes that current voluntary efforts alone will not sufficiently 
address the security concerns of the entire sector. Any new authorities should allow DHS to 


Unless otherwise stated all answers are current as of the date of the hearing. 


Page 1 of 9 



50 


Questions For the Record 

Senate Homeland Security and Governmental Affairs Committee 
"Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?" 

June 1 5, 2005 

Acting Under Secretary Robert B. Stephan 

enforce reasonable, clear, and measurable performance standards, based on risk, that reflect the 
diversity of the sector and take into account protective measures taken by industry to date. 

3. The 1984 incident in Bhopal, India thrust the idea of chemical safety upon the Federal 

Government, just as the horrific attacks of September 11th forced the Federal Government to 
address homeland security. Recognizing the interdependencies of safety and security is 
essential as we address the chemical industry. While the EPA effectively addresses the 
safety of these facilities, we need to ensure that security is also being addressed, yet we 
cannot conflate these fundamentally different temis. Security encompasses the risks facilities 
face from a potential attack, while safety needs to apply to all facilities. 

• From your unique perspectives, can you both address the relationship of DHS and EPA as it 
pertains to the safety and security of our chemical fecilities? 

Response: Although DHS and the EPA are equally concerned with protecting the welfare of the 
general public, our respective missions, and therefore our approach to evaluating the hazard and 
risks associated with the chemical sector, are different. While the EPA’s assessments are 
focused on safety and protecting against accidental releases, DHS^ focus is on the security of the 
sector in the context of the threat of deliberate attack. Both agencies understand the differences 
between these approaches and continue to work cooperatively. 

• How is DHS ensuring that it focuses on security and those facilities that present the highest 
risk? Is intelligence incorporated into the protective actions and priorities DHS outlines for 
the chemical sector? 

Response: In 2003, DHS conducted consequence analysis of the chemical sector to identify the 
most hazardous or highest consequence sites. Using the EPA Risk Management Plan (RMP) 
database as the foundation for this analysis, DHS: 

• Evaluated possible impacts of intentional attack using the accidental release model used in 
EPA safety programs 

• Reviewed the amount and type of toxic materials stored at sites 

• Identified population density in the vicinity of sites storing large amounts of toxic chemicals 

• Conducted plume modeling for more detailed prediction of potential effects 

Through this analysis, DHS identified approximately 3,400 chemical manufacturing facilities of 
national consequence, or in other words with the potential to adversely affect* 1,000 or more 
people under a catastrophic breach scenario. The definition of 'adverse affects’ is guided by the 
American Industrial Hygiene Association’s (AIHA) Level of Concern of Emergency Response 
Planning Guidance Level 2 (ERPG-2); which is an emergency response level used to describe 
the effects of human exposure to a chemical release. Specifically, ERPG-2 is a guidance for 


* As defined by the Environmental Protection Agency (EPA) 
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Questions For the Record 

Senate Homeland Security and Governmental Affairs Committee 
“Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?" 

June 15, 2005 

Acting Under Secretary Robert B. Stephan 

chemical facilities where an intentional chemical release results in a maximum airborne 
concentration below, and which it is believed that nearly all individuals could be exposed for up 
to one hour without experiencing or developing irreversible or other serious health effects or 
symptoms which could impair an individual’s ability to take protective actions. Any asset 
determined to be of national consequence is subjected to a risk analysis, which is a combined 
assessment of: 

• Consequence (estimates of the damage a successful attack would cause) 

• Threat (estimates of the likelihood that a particular target or type of target will be selected 
for attack based on the best available Intelligence) 

• Vulnerability — assess which elements of infrastructure or individual are most 
susceptible to attack and how attacks against these elements would be most likely earned 
out. 

One of the Department’s principal risk-assessment tools is RAMCAP (Risk Assessment 
Methodology for Critical Asset Protection). RAMCAP (and other risk methodologies) enables 
the Office of Infrastructure Protection to compare the risk of critical infrastructure assets within 
the chemical sector, thereby enabling DHS to prioritize of protective efforts and effective use of 
available resources. 

4. Today is the first time that I can recount DHS publicly requesting regulatory authority. As 
the Committee considers legislation, we need to ensure that we do not place too many 
onerous requirements upon industry and that new regulations complement existing MTSA 
and EPA regulations. This is a difficult task, yet necessary to strengthen our homeland 
security. As DHS contemplates regulation, I am interested in what other sectors may be 
affected by regulations. 

• Does DHS believe that it will regulate other sectors? How will DHS ensure that its 
regulations do not conflict with EPA regulations? 

Response: The Department will continue to work closely with the EPA and its other Federal 
partners to ensure that any new regulations are not duplicative or in direct conflict with existing 
regulatory efforts. Currently, the Department has no plans to regulate other sectors. 

5. As a former Mayor, I am very familiar with the critical role that first responders - local 
police and firefighters - will play in responding to any terrorist incident. In addition to 
preparing for an accidental spill, first responders need to be prepared to respond to a terrorist 
attack upon a chemical industry. To properly respond, this response capability needs to be 
exercised. 

• Do DHS and EPA work on the specifics of responding to a chemical site after an attack, 
rather than an accident? Are exercises conducted at the local level? And, finally, are state 
and local governments included in these exercises? 


Unless otherwise staled all answers are current as of the date of the hearing. 
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Questions For the Record 

Senate Homeland Security and Governmental Affairs Committee 
“Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?” 

June 15, 2005 

Acting Under Secretary Robert B, Stephan 

Response: The Department is in the process of planning Comprehensive Reviews for the 
nation’s Chemical Sector. These reviews, which are a combined effort by the Federal 
government, including the EPA, local authorities and emergency response personnel, and 
owner/operators to review existing security practices and capabilities at all levels, also examine 
local response plans for an attack on a specific facility. 

As part of DHS Exercise Program, tabletop exercises that simulate an attack on a facility were 
conducted at six of the highest consequence chemical facilities. These exercises included state 
and local participants, and results have been compiled for use in planning future exercises, 
upgrading security plans and operating procedures, taking corrective actions, and allocating 
resources. 


Questions for the Record from Senator Joseph I. Lieberman 
Site Assistance Visits 

1 . Since there are currently no legislated security standards covering most chemical 

facilities, DHS has worked with the industry on a voluntary basis to assess vulnerabilities 
and recommend improvements. However, without authority to require that security be 
enhanced, or ensure compliance, DHS has to rely on the willingness of the owner or 
operator to cooperate. You testified that the Department has conducted 38 “Site 
Assistance Visits” (SAVs) at 38 of the highest consequence facilities, and an additional 
50 visits are planned for FY 06 and that the Department has identified some 300 facilities 
which could place at least 50,000 citizens at risk. 

A. What is the Department’s timetable for visiting high-risk chemical facilities? How many 
do you plan to visit each year? 

Response: DHS has identified about 3,400 chemical sites that could adversely affect 1,000 or 
more people if attacked. Within that, there are categories between 1,000 and 50,000 people 
affected, 50,000 to 500,000 people possibly affected, and then above 500,000. The Department 
is in the process of planning Comprehensive Reviews (CR) for the chemical sector, which is a 
combined effort by the Federal government, local authorities, emergency response personnel, 
and owner/operators to review existing security practices and capabilities at all levels. DHS had 
planned to start visiting the highest consequence sites, tiers one and two, in Fall of 2005, and to 
complete the CRs at these sites early in 2006. However, the DHS response efforts to Hurricane 
Katrina have greatly impacted the CR schedule. Although an official revised schedule has not 
been established, it is safe to assume that all dates have been pushed back. 

B. Would DHS timetable be accelerated with additional resources? If so, do you plan to 
request that Congress provide more? 

Response: The Department plans to evaluate high-risk chemical facilities in the near future via 
the Comprehensive Review effort, and at this time does not plan to request additional resources. 


Unless otherwise stated all answers are current as of the date of the hearing. 
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Questions For the Record 

Senate Homeland Securih/ and Governmental Affairs Committee 
'Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?” 

June 1 5, 2005 

Acting Under Secretary Robert B. Stephan 


“High Risk Facilities” 

2 . You further testified that the facilities not currently abiding by a voluntary chemical code 
represents 20% of the country’s “high-risk” chemical operating capacity. 


A. How does DHS define “high-risk chemical operating capacity?” 

B. What factors does the Department take into account when determining whether a facility 
represents part of this capacity? 

Response A & B: The 3,400 chemical sites identified by DHS that could adversely affect 1,000 
people if attacked. 

Need for Safer Technologies 

3. Some advocates contend that it is virtually impossible to adequately protect some 
chemical facilities from physical attack; for example a facility with its tanks located near 
the fence line, and abutting a major highway. Numerous scenarios can be envisioned 
where physical security at a chemical plant - no matter how robust - might fail. Given 
that reality, wouldn’t it be easier to guard such a place if the facility had implemented 
available and cost-effective improvements to reduce the amount of acutely dangerous 
chemicals used in the process, used a safer chemical to perform the same task, reduced 
hazardous pressures or temperatures, or manufactured the chemical just in time for it to 
be used in the process? 

Response: In some cases, changes in processes may reduce the risk to a chemical facility. In 
fact, private sector owners and operators typically evaluate a number of options when 
determining what processes they will use. In fact, such consideration is an embedded practice in 
the chemical sector. 

Within the industry, inherently safer technology (1ST) includes the procedures cited in the 
question. Althou^ it is the site owner-operators’ right to evaluate and employ the process that 
they deem fit (within the confines of the law) it is important to note that, when applied to 
security, 1ST will most often simply move vulnerability from one place to another. Additionally, 
misapplication of 1ST to security issues may sometimes compromise safety. 

4. In your written statement, you point out that “the particular vulnerability of any specific 
facility obviously depends on the type and quantity of chemicals at a site, the physical 
layout, and location of sensitive targets, access points, geographic location, and other 
variables. Therefore, each facility must have a vulnerability assessment - and a security 
plan - tailored to its unique characteristics.” How important is the type and quantity of 
chemicals to the vulnerability assessment for security planning purposes? 
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Senate Homeland Security and Governmental Affairs Committee 
■‘Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?" 

June 15, 2005 

Acting Under Secretary Robert B. Stephan 

Response; When evaluating risk, the Department must weigh the potential consequences 
associated with an attack, and does so by closely examining the facility itself and the chemicals in 
or near that facility. The quantity and type of chemicals contained within a specific facility are an 
important factor in determining the consequences of a teirorist attack. For example, chlorine is 
more immediately hazardous, and is therefore more consequential, to people than bleach. A site 
that stores or manufactures chlorine will of necessity fall into a higher risk category. 

DHS role in security of rail shipments 

5. Concern over the rail shipment of hazardous chemicals has been mounting. In 2001, a 
joint study commissioned by the U.S. Coast Guard and the National Transportation 
Safety Board found that the rupture of one 90-ton tank car of chlorine gas could produce 
a potentially lethal toxic cloud nearly 20 miles wide. The Naval Research Laboratory 
also testified in the same year that an attack or accident involving one of these tank cars 
could put more than 1 00,000 people at risk in just 1 5 to 30 minutes and cause “exposed 
individuals to die at a rate of 1,000 per second.” Moreover, the EPA estimated that a 
“worst-case” accident involving just one 90-ton tank car of chlorine gas would cause a 
“danger zone” of 14 miles, and at a 2004 press conference, representatives from the FBI 
said that rail cars are an easy target for terrorists. 

A. In 2003, the GAO concluded that DHS and DOT should develop a specific plan to 

determine the adequacy of rail security measures already in place and to identify gaps in 
rail security. Has such a plan been prepared? Do you believe it should be prepared and if 
so, by when? 

Response: The Department is working in conjunction with the Department of Transportation 
(DOT) and railroad property owners to perform site visits. The purpose of these visits is to 
determine transportation security gaps and vulnerabilities. From the information gathered, DHS 
and DOT will form best practices that will ultimately lead to the plan cited above. In determining 
the adequacy of rail security measures, mitigating factors such as the strategic placement of rail 
cars in rail yards will be taken into account. 

Certain classes of hazardous materials (HAZMAT), such as those chemicals classified as toxic 
by inhalation (TIH), may pose a threat to public safety, security, or the environment during 
transportation because of their physical and chemical properties. In April 2004, the Homeland 
Security Council (HSC) tasked the Department of Homeland Security (DHS) and the Department 
of Transportation (DOT) with taking action to improve the security of TIH shipments by rail. As 
part of the approach to implement the HSC’s recommendations, DHS and DOT have been 
working on various initiatives that support the development of a national risk-based plan. The 
Departments are focusing on the assessments of vulnerabilities of high threat luban areas where 
TIH materials are transported; identification of practical alternatives to placards on rail tank cars; 
new rail car design standards; and ways to enhance the development and implementation of 
HAZMAT security plans, which are required by Federal regulations issued in March 2003, to 
improve the adequacy and effectiveness of industry security plans. 
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Senate Homeland Security and Governmental Affairs Committee 
Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?" 

June 15, 2005 

Acting Under Secretary Robert B. Stephan 


The High Threat Urban Areas (HTUAs) Corridor Assessment program is part of this effort. A 
DHS/DOT team working in partnership with the participating railroad owners/operators is 
conducting vulnerability assessments of HTUAs where TIH materials are transported by rail in 
significant quantity. The purpose of these studies is to develop mitigation strategies to address 
identified vulnerabilities. 

In passenger rail, TSA has been actively conducting Corporate Security Reviews (CSRs) which 
provide DHS with a baseline of existing security. A primary goal of the CSRs is to identify gaps 
in security of passenger rail and mass transit operations. This effort is greatly enhanced by the 
Surface Transportation Inspector program; implemented through a $10 million appropriation in 
the Department of Homeland Security Appropriations Act for Fiscal Year 2005. To date, more 
than 60 inspectors have been deployed to the field. TSA expects to have hired all 100 inspectors 
by October 2005. The inspectors will identify gaps in security and inspect for compliance with 
security measures. 

The Department is also actively working on pilot projects that will assist in the effort to identify 
gaps in rail security. These pilot projects will, through the cooperative efforts of our partners in 
the private sector, and State and local governments, leverage technology to our advantage to 
create a virtual fence to gather and disseminate data, while protecting privacy and securing 
critical and highly trafficked urban areas. 


B. Do you support legislation that would require DHS to prepare a vulnerability assessment 
of freight rail transportation and to identify security risks that are specific to the rail 
transport of hazardous materials? 

Response: The Transportation Security Administration (TSA) recognizes that S.1379 includes a 
provision that would require DHS to complete vulnerability assessments of rail freight and rail 
passenger transportation, which includes the identification of vulnerabilities specific to the 
transportation of hazardous materials. In the 108* Congress, DHS submitted an official views 
letter commenting on similar legislation, S. 2273. That letter stated that DHS generally 
concurred with the objectives of the legislation. 

DHS is particularly interested in leveraging industry efforts as part of its risk assessments. For 
example, the Office of State and Local Government Coordination and Preparation (OSLGCP) is 
in the process of awarding a grant to fund a risk assessment tool for application in the freight rail 
environment. That tool, the Rail Corridor Risk Management Tool (RCRMT), will be developed 
in coordination and cooperation with DOT and various agencies within DHS, along with the full 
participation of industry. Additionally, the Department has created a multi-agency task force 
that teams with industry partners, to conduct comprehensive security reviews of the rail corridors 
in HTUAs that facilitate the shipment of TIH materials. In addition to other HTUAs, an 
assessment has been completed on the NCR rail corridor. Additional assessments are ongoing. 
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Questions For the Record 

Senate Homeland Security and Governmental Affairs Committee 
"Is the Federal Government Doing Enough to Secure Chemical Facilities and is More Authority Needed?' 

June 15. 2005 

Acting Under Secretary Robert B. Stephan 

6. My understanding is that as part of the RAMCAP program, DHS relies exclusively on the 
in-house chemical engineering expertise within the owners and operators’ facilities and 
does not any chemical engineers on staff at DHS to verify the findings and conclusions 
made by the facilities’ chemical engineers. 

A. Is that correct? 

Response: Although the Department has designed RAMCAP to incorporate the knowledge and 
expertise of industry personnel, it does not depend exclusively on their conclusions when 
analyzing data. DHS security experts, field persoimel, and contracted subject matter experts will 
verify and validate RAMCAP submissions to ensure information provided is accurate and 
representative as possible of each specific facility. 

B. If so, how are you able to have independent assurance of the facilities’ chemical 
engineers findings and conclusions? 

Response: As mentioned above, DHS security experts, field persoimel, and contracted 
specialists will work cooperatively to assess each facility’s RAMCAP submission. 

C. Do you see a need for DHS to hire or contract independent chemical engineers to 
participate in the RAMCAP process? 

Response: The Department has already secured the necessary subject matter expertise needed to 
support the RAMCAP process. 

Questions for the Record from Senator Daniel K. Akaka 

1 . In your written testimony you stated that the Office of Infrastructure Protection (IP) has 
sector specialists who assist with security assessments in their field of expertise. 

Will you please tell me how many chemical sector specialists IP currently has on staff? 

Response: Currently the Office of Infrastructure Protection (IP) has three federal chemical sector 
specialists on staff, with plans to hire more. The Department has also contracted subject matter 
experts to augment federal sector specialists for each of the numerous critical infrastructure 
sectors for which IP has overarching responsibility. 

2. GAO reported at the April 27th hearing that DHS has not yet determined the number and 
type of facilities that should be considered part of the chemical infrastructure sector. 

Why hasn’t this been done and when will a definition of the chemical infrastructure 
sector be complete? 


Unless otherwise stated all answers are current as of the date of the hearing. 
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Questions For the Record 

Senate Homeland Security and Governmental Affairs Committee 
“Is the Federal Government Doing Enough to Secure Chemical Facilities and Is More Authority Needed?” 

June 15. 2005 

Acting Under Secretary Robert B. Stephan 

Response: The Department of Homeland Security (DHS), as a policy and operational matter, 
defines the chemical sector as encompassing fixed facilities, as determined by the Secretary, the 
primary purpose of which is to manufacture chemicals and to serve as a transfer terminal and/or 
storage facility for chemicals. 

3. What financial and human resources will be required for DHS to execute chemical 
security regulation that includes: promulgating regulations; certifying facilities; verifying 
the certification; and enforcing compliance? 

Response: To a large extent, resource requirements will depend on the specific authorities 
granted in the enabling legislation. Any estimates at this time would be highly speculative. 

4. In response to a question I asked you at the hearing about the use of contractors in 
chemical security regulation, you stated that while federal employees would manage a 
chemical security regulation office, you could envision using contractors to do other jobs 
such as inspections. The Environmental Protection Agency (EPA) has a cadre of federal 
employees with special expertise in the chemical industry. 

Have you considered using EPA employees to help with the inspection and verification 
functions instead of contracting out the jobs to non-federal personnel? 

Response: The Department will continue to work closely with all of its Federal partners in the 
National Infrastructure Protection Plan, and continue to leverage the expertise of other 
departments and agencies, where it exists and as appropriate. 


Unless otherwise slated all answers are current as of the date of the hearing. 
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Post-Hearing Questions for the Record 
Submitted to Thomas P. Dunne 
From Senator IVorm Coieman 

“Is the Federal Government Doing Enough to Secure Chemical Facilities 
and Is More Authority Needed?” 

June 15, 2005 


Coleman -The 1984 incident in Bhopal, India thrust the idea of chemical safety upon the Federal 
Government, just as the horrific attacks of September 1 1th forced the Federal Government to 
address homeland security. Recognizing the interdependencies of safety and security is essential 
as we address the chemical industry. While the EPA effectively addresses the safety of these 
facilities, we need to ensure that security is also being addressed, yet we cannot conflate these 
fundamentally different terms. Security encompasses the risks facilities face from a potential 
attack, while safety needs to apply to all facilities. 

Question: From your unique perspectives, can you both address the relationship of DHS and 
EPA as it pertains to the safety and security of our chemical facilities? 

Answer: EPA’s authorities for chemical facility safety are principally contained in section 
112(r) of the Clean Air Act (CAA), which authorizes EPA to issue accidental release 
prevention, mitigation and correction regulations that include, among other things, 

“design, equipment, work practice, and operational requirements.” The CAA and EPA’s 
regulations (40 CFR Part 68) require facilities that have more than threshold quantities of 
any of 140 listed highly toxic or flammable substances to implement a chemical accident 
prevention program, emergency response program, and to submit to EPA a description of 
that program called a Risk Management Plan (RMP) that includes a worst case scenario. 
Implementation of these requirements also contributes to site security by, for example, 
ensuring that chemical processes are properly operated, well-maintained and that 
emergency response plans are in place. 

Homeland Security Presidential Directive 1 (HSPD-7) designates DHS as the lead 
federal department for security of chemical sector infrastructure and assets. DHS also 
serves as overall coordinator for the supporting efforts of other appropriate departments 
and agencies, including EPA. Therefore, in terms of chemical facility security, EPA 
currently serves in a supporting role to DHS, participating in DHS-led efforts such as the 
chemical sector Government Coordinating Council (GCC). The GCC is a mechanism to 
provide effective coordination of critical infrastructure strategies and activities, policy, and 
communication across government to support the nation’s homeland security mission. 

EPA and DHS have also worked together with organizations such as the Center for 
Chemical Process Safety to develop methods for chemical facilities to assess their security 
vulnerabilities. 
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Although the two can involve different approaches, chemical facility safety and 
security are overlapping imperatives. For example, hazardous chemical containment is a 
critical consideration for both facility safety and security. Safety measures taken in this 
regard will generally focus on process design and management measures aimed at 
preventing loss of containment. Such measures might include vessel design features, 
equipment inspections, installation of process control devices, alarms and interlocks, and 
implementation of operating procedures to maintain process parameters within specified 
limits. Some of these safety features will have the secondary benefit of enhancing facility 
security, but by themselves might not be sufficient to ensure facility security. From a 
security standpoint, additional measures outside the traditional realm of process safety 
might be necessary to address unique security concerns, such as prevention of external 
attack or equipment sabotage. Therefore, as the Department of Homeland Security moves 
forward in its efforts to provide for security of the chemical sector, it is important that EPA 
and DHS continue to work together to ensure that safety and security requirements are 
well-coordinated. 

Coleman —As a former Mayor, I am very familiar with the critical role that first responders - 
local police and firefighters - will play in responding to any terrorist incident. In addition to 
preparing for an accidental spill, first responders need to be prepared to respond to a terrorist 
attack upon a chemical industry. To properly respond, this response capability needs to be 
exercised. 

Question: Do DHS and EPA work on the specifics of responding to a chemical site after an 
attack, rather than an accident? Are exercises conducted at the local level? And, finally, are 
state and local governments included in these exercises? 


Answer: DHS and EPA, along with many other departments and agencies at the federal, 
state, and local level work together to prepare for chemical emergencies, whether those 
emergencies involve accidents or terrorism. An important initiative toward this end is the 
development and implementation of a National Response Plan (NRP), and a new National 
Incident Management System (NIMS). The NRP and NIMS align the old U.S. national 
response system into a more cohesive structure that integrates the capabilities and 
resources of various governmental jurisdictions, incident managers, and emergency 
response organizations into a national framework for domestic incident management. The 
NIMS provides a nationwide template enabling Federal, State, local, and tribal 
governments, and private sector and nongovernmental organizations to work together to 
prevent, prepare for, respond to, and recover from domestic incidents regardless of cause, 
size, or complexity. The NRP incorporates and supersedes previous national response 
plans, and has become the Federal all-hazards plan that provides the structure and 
mechanisms for national-level policy and operational direction for domestic incident 
management. 

Under these plans, numerous exercises involving federal, state, and local 
government are periodically conducted to improve our ability, at all levels of government, 
to respond to terrorist attacks. For example, earlier this year DHS led the Top Officials 3 
(TOPOFF-3) exercise, which simulated simultaneous chemical and biological terrorist 
attacks in Conncctlcnt and New Jersey. This exercise involved real on-scene deployment of 
local, state, and federal responders and response resources, intensive drill interplay by 
state and federal government departments at headquarters operations centers, and 
involvement of foreign countries including Canada and Great Britain. 
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Post-Hearing Questions for the Record 
Submitted to Thomas P. Dunne 
from Senator Daniel K. Akaka 

“Is the Federal Government Doing Enough to Secure Chemical Facilities 
and Is More Authority Needed?” 

June 15, 2005 


Question: In your opinion, has DHS worked effectively with the EPA to capitalize on the RMP 
vulnerability and preparedness information since DHS became the lead on chemical security, and 
where could cooperation improve? 

Answer: In December 2003, Homeland Security Presidential Directive 7 designated the 
Department of Homeland Security (DHS) as the lead agency for chemical sector security. 
Since that time, EPA has worked with DHS on chemical security issues as requested on 
various occasions. For example, EPA provides updated versions of the RMP database to 
DHS, and has provided analytical support upon request. EPA is also a member of DHS 
Chemical Sector Risk Analysis and Management for Critical Asset Protection (RAMCAP) 
project team, which involves development of sector-specific screening tools and collection 
of industry specific information to allow prioritization of chemical sector assets, 
development of a sector-specific Security Vulnerability Analysis (SVA) methodology, and 
documentation of industry security practices. Additionally, EPA participates on DHS's 
chemical sector Government Coordinating Council (GCC). The GCC is a mechanism to 
provide effective coordination of critical infrastructure strategies and activities, policy, and 
communication across government to support the nation's homeland security mission. 
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Post-Hearing Questions for the Record 
Submitted to Thomas P. Dunne 
From Senator Joseph I. Lieberman 

“Is the Federal Government Doing Enough to Secure Chemical Facilities 
and Is More Authority Needed?” 

June 15, 2005 


Role of Local Emergency Planning Committees 

Lieberman — In order to adequately protect the American people from the potential 
consequences of an attack on chemical facilities, citizens in potentially affected areas 
must be fully aware of how to respond. In that respect, the role of Local Emergency 
Planning Committees (LEPC) and State Emergency Response Commissions, which are 
required by the Emergency Plaiming and Community Right to Know Act, takes on added 
significance in the event of a terrorist attack. At HSGAC’s April 27"’ hearing, Chairman 
Carolyn Merritt of the U.S. Chemical Safety Hazard Investigation Board testified that 
numerous accident investigations conducted by the Board reveal serious gaps in how well 
emergency responders, as well as the public, are prepared for a major release which 
suggests that in some places LEPCs either don’t exist or are not very effective. 


Question: Has EPA conducted any assessments of the effectiveness of Local Emergency 
Planning Committees since 9/11? If not, why not? 

Answer: EPA’s last nationwide LEPC survey was conducted in 2000 and focused 
on the status of LEPC activities as required by the Emergency Planning and 
Community Rlght-to-Know Act (EPCRA) as well as LEPC activities relating to 
accident prevention and counter terrorism. EPA has not conducted any assessments 
of LEPC effectiveness since September 11, 2001 primarily because of Agency 
attention to other priorities. EPA currently has plans underway to conduct another 
survey in 2006. This assessment will focus on LEPC effectiveness with regard to 
EPCRA compliance and will also seek to identify new challenges in the area of 
prevention and homeland security. 

Question: According to EPA officials, who briefed staff prior to the hearing, one of 
the major obstacles facing LEPCs across the country is that they lack funding. Many 
LEPCs are essentially volunteer organizations operating without any real resources. Do 
you support providing federal resources to buttress the work of LEPCs? If so, how much 
do you believe is needed for these committees? 


Answer: Although EPA provides no funding for LEPCs, the Agency does provide 
non-financial support to LEPCs and State Emergency Response Commissions 
(SERCs), including development and distribution of free software tools and 
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guidance documents to aid LEPCs and SERCs 'with management of information 
and emergency planning and response, and ongoing technical assistance and 
exercise support to SERCs and LEPCs from EPA Regional offices. EPA also 
encourages SERCs and LEPCs to work within their states to integrate their 
activities with Homeland Security initiatives, creating possibilities for work with “all 
hazards results” funded by FEMA, the Department of Justice and now DHS. 
Historically, some active LEPCs are partially funded by State fee systems associated 
with EPCRA reports. 

Question: Do you know if there are adequate evacuation plans in place for people near 
high-risk chemical plants? Who at the federal level is working to ensure that such plans 
are in place and that they are effective? 

Answer: EPCRA requires LEPCs to prepare community emergency response 
plans. Those plans must identify facilities and transportation routes of extremely 
hazardous substances, describe emergency response procedures on and off-site, 
designate a community coordinator and facility coordinator(s) to implement the 
plan, outline emergency notification procedures, describe how to determine the 
probable affected area and population by releases, describe local emergency 
equipment and facilities and the persons responsible for them, outline evacuation 
plans, provide a training program for emergency responders, and provide methods 
and schedules for exercising emergency response plans. EPCRA places the 
responsibility for reviewing community response plans on State Emergency 
Response Commissions (SERCs), rather than any Federal department or agency. 

Reducing Hazards via Process Design 

Question: EPA previously indicated that reducing hazards via site or process design is 
preferable to adding on safety or security measures. For example, in a chemical security 
alert issued in February 2000, EPA wrote - “Facility and process design (including 
chemicals used) determine the need for safety equipment, site security, buffer zones, and 
mitigation plaiming. Eliminating or attenuating to the extent practicable any hazardous 
characteristic during facility or process design is generally preferable to simply adding on 
safety equipment or security measures." Is this still EPA’s position? 

Answer: Eliminating or reducing hazards during initial facility or process design, 
where feasible, will often provide for a higher level of facility safety or security. For 
example, if process design eliminates the need for a particular hazardous chemical, 
then the chemical is never used in the process, its hazards do not need to be 
managed or controlled, and it can not be accidentally or intentionally released to 
harm anyone on or near the facility. However, it is often not feasible to completely 
eliminate or adequately reduce hazards during process design; in such cases, the 
process design integrated with additional “layers of protection” using safety 
equipment and security measures are necessary to properly manage remaining risks 
and/or changing hazards. 
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Question: In a HSGAC hearing on April 27, Richard Falkenrath, former Deputy 
Assistant to the President for Homeland Security Advisor, testified in favor of what he 
called a market based approach to the issue of safer technologies. He testified that if the 
physical security requirements for companies where the consequences of an attack would 
be greatest are truly adequate, facility owners would consider changing processes or 
reducing stockpiles of hazardous chemicals without government mandating that they do 
so. Does EPA’s experience with industry’s response to existing safety regulations 
support Dr. Falkenrath’s conclusion? Please provide some evidence to substantiate your 
response. 

Answer: EPA has no evidence to support the conclusion that market forces alone 
are sufficient to ensure adequate safety or security at hazardous chemical facilities. 
While it is true that many chemical facilities have taken voluntary action to provide 
for their safety and security, EPA officials have also observed during facility visits 
and inspections that some high-hazard chemical facilities did not take sufficient 
voluntary actions. Therefore, the Agency believes that federal safety and security 
requirements are necessary to ensure high-risk chemical facilities implement 
appropriate safety and security measures. 
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